一些内核操作函数

#ifdef __cplusplus
extern "C" {
#endif

#define DELAY_ONE_MICRO (-10)
#define DELAY_ONE_MILLI (DELAY_ONE_MICRO*1000)
#include <ntifs.h>
#include <stdlib.h>
	NTSTATUS DriverEntry(IN PDRIVER_OBJECT  objDriver,IN PUNICODE_STRING strRegPath);

	HANDLE KernelCreateFile(IN PUNICODE_STRING pstrFile,IN BOOLEAN bIsDir);

	ULONG64 KernelGetFileSize(IN HANDLE hFile);

	ULONG64 KernelReadFile(IN HANDLE hFile,IN PLARGE_INTEGER Offset,IN ULONG ulLength,OUT PVOID pBuffer);
	ULONG64 KernelWriteFile(IN HANDLE hFile,IN PLARGE_INTEGER Offset,IN ULONG ulLength,OUT PVOID pBuffer);
	NTSTATUS KernelDeleteFile(IN PUNICODE_STRING pstrFile);

	void KernelKillProcess(UINT32 PiD);

	PEPROCESS LookupProcess(HANDLE hPid);
	NTKERNELAPI HANDLE PsGetProcessInheritedFromUniqueProcessId(IN PEPROCESS pEProcess);
	NTKERNELAPI UCHAR* PsGetProcessImageFileName(IN PEPROCESS pEProcess);
	VOID EnumProcess();

	PFILE_BOTH_DIR_INFORMATION KernelFindFirstFile(IN HANDLE hFile,IN ULONG ulLen,OUT PFILE_BOTH_DIR_INFORMATION pDir);
	NTSTATUS KernelFindNextFile(IN OUT PFILE_BOTH_DIR_INFORMATION* pDir);
	void Traversal();

	NTKERNELAPI NTSTATUS PsSuspendProcess(PEPROCESS pEProcess);
	NTKERNELAPI NTSTATUS PsResumeProcess(PEPROCESS pEProcess);

	UINT32 PauseProcess(PEPROCESS pEProcess);
	UINT32 ResumeProcess(PEPROCESS pEProcess);

	typedef NTSTATUS (__stdcall *PSSUSPENDTHREAD)(IN PETHREAD pEThread,OUT PULONG PreviousSuspendCount);
	typedef NTSTATUS (__stdcall *PSRESUMETHREAD)(IN PETHREAD pEThread,OUT PULONG PreviousCount);
	PSSUSPENDTHREAD PsSuspendThread = (PSSUSPENDTHREAD)0x842de1bb;
	PSRESUMETHREAD PsResumeThread = (PSRESUMETHREAD)0x84235cd6;

	UINT32 PauseThread(PETHREAD pEThread);
	UINT32 ResumeThread(PETHREAD pEThread);

	KEVENT g_kEvent;
	
	VOID t_funThread(IN PVOID StartContext);
	VOID Test_CreateThread();

	typedef NTSTATUS (__fastcall *ZWTERMINATETHREAD)(HANDLE hThread,ULONG uExitCode);
	ZWTERMINATETHREAD ZwTerminateThread = (ZWTERMINATETHREAD)0x8407fad4;
	void KernelKillThread(UINT32 TiD);
	NTSTATUS ZwOpenThread(OUT PHANDLE ThreadHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL);
	VOID EnumThread(PEPROCESS pEProcess);

	VOID KernelSleepA(LONG MicroSeconds);
	VOID KernelSleepB(LONG MicroSeconds);

	ULONG KernelGetVersion();

	VOID Test_GetCurrentTime();
#ifdef __cplusplus
}
#endif

HANDLE KernelCreateFile(IN PUNICODE_STRING pstrFile,IN BOOLEAN bIsDir)
{
	HANDLE hFile = NULL;
	NTSTATUS Status = STATUS_UNSUCCESSFUL;
	IO_STATUS_BLOCK StatusBlock = {0};
	ULONG ulShareAccess = FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE;
	ULONG ulCreateOpt = FILE_SYNCHRONOUS_IO_NONALE