win10驱动开发13——文件操作

创建文件；写文件；读取文件；删除文件（未实现）

#include <ntddk.h>   

VOID Unload(IN PDRIVER_OBJECT pDriverObject)
{
	//驱动卸载的时候显示
	KdPrint(("Goodbye driver\n"));
}
//创建文件方式一
VOID CreateFileTest1() 
{
	HANDLE hFile;//文件句柄
	NTSTATUS status;//返回状态
	IO_STATUS_BLOCK IoStatus;//文件的操作结果
	UNICODE_STRING FilePath = RTL_CONSTANT_STRING(L"\\??\\C:\\test.log");//文件路径


	OBJECT_ATTRIBUTES oa;
	//初始化方式一
	//oa.Length = sizeof(oa);
	//oa.ObjectName = &FilePath;
	//oa.Attributes = OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE;
	//oa.RootDirectory = NULL;
	//oa.SecurityDescriptor = NULL;
	//oa.SecurityQualityOfService = NULL;
	//初始化方式二
	InitializeObjectAttributes(&oa,&FilePath,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,NULL,NULL);
	status = ZwCreateFile(&hFile,
		GENERIC_ALL,
		&oa,
		&IoStatus,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		FILE_OPEN_IF,
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,
		0);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件创建失败",status));
		return;
	}
	KdPrint(("文件创建成功"));
	ZwClose(hFile);
}
//创建文件方式二
VOID CreateFileTest2()
{
	HANDLE hFile;//文件句柄
	NTSTATUS status;//返回状态
	IO_STATUS_BLOCK IoStatus;//文件的操作结果
	UNICODE_STRING FilePath = RTL_CONSTANT_STRING(L"\\??\\C:\\test2.log");//文件路径
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, &FilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	status = IoCreateFile(&hFile,
		GENERIC_ALL,
		&oa,
		&IoStatus,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		FILE_OPEN_IF,
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,
		0,
		CreateFileTypeNone,
		NULL,
		IO_NO_PARAMETER_CHECKING  
		);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件2创建失败", status));
		return;
	}
	KdPrint(("文件2创建成功"));
	ZwClose(hFile);
}
//读取文件属性
VOID QueryFileAttribute() 
{
	HANDLE hFile;//文件句柄
	NTSTATUS status;//返回状态
	IO_STATUS_BLOCK IoStatus;//文件的操作结果
	UNICODE_STRING FilePath = RTL_CONSTANT_STRING(L"\\??\\C:\\test2.log");//文件路径
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, &FilePath, OBJ_CASE_INSENSITIVE , NULL, NULL);
	status = ZwOpenFile(&hFile,FILE_ALL_ACCESS,&oa,&IoStatus,FILE_SHARE_READ,FILE_SYNCHRONOUS_IO_NONALERT);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件打开失败\n"));
		return;
	}
	FILE_STANDARD_INFORMATION fsi;
	status = ZwQueryInformationFile(hFile, &IoStatus, &fsi, sizeof(fsi),FileStandardInformation);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件信息查询失败\n"));
		ZwClose(hFile);
		return;
	}
	KdPrint(("文件的大小%d字节\n",fsi.EndOfFile.LowPart));
	ZwClose(hFile);
}
//写文件
VOID  WriteFileTest() 
{
	HANDLE hFile;//文件句柄
	NTSTATUS status;//返回状态
	IO_STATUS_BLOCK IoStatus;//文件的操作结果
	UNICODE_STRING FilePath = RTL_CONSTANT_STRING(L"\\??\\C:\\test2.log");//文件路径
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, &FilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	status = ZwCreateFile(&hFile,
		GENERIC_ALL,
		&oa,
		&IoStatus,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		FILE_OPEN_IF,//存在就打开否则就创建
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,
		0);

	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件2创建失败", status));
		return;
	}
	KdPrint(("文件2创建成功"));
	ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatus, "这是写入的文件内容", strlen("这是写入的文件内容"), NULL, NULL);
	ZwClose(hFile);
}
//读文件
VOID ReadFileTest() 
{
	HANDLE hFile;//文件句柄
	NTSTATUS status;//返回状态
	IO_STATUS_BLOCK IoStatus;//文件的操作结果
	UNICODE_STRING FilePath = RTL_CONSTANT_STRING(L"\\??\\C:\\test2.log");//文件路径
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, &FilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	status = ZwCreateFile(&hFile,
		GENERIC_ALL,
		&oa,
		&IoStatus,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		FILE_OPEN_IF,//存在就打开否则就创建
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,
		0);

	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件2创建失败", status));
		return;
	}
	KdPrint(("文件2创建成功"));
	CHAR buffer[1024] = {0};
	ZwReadFile(hFile, NULL, NULL, NULL, &IoStatus, buffer, sizeof(buffer), NULL, NULL);
	KdPrint(("读取的文件内容：%s\n", buffer));
	ZwClose(hFile);
}

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{	
	CreateFileTest1();
	CreateFileTest2();
	WriteFileTest();
	ReadFileTest();
	QueryFileAttribute();
	KdPrint(("Hello driver\n"));
	DriverObject->DriverUnload = Unload;
	return STATUS_SUCCESS;
}