同步与异步
kernel32.dll
CreateFileW
/* translate the flags that need no validation */
if (!(dwFlagsAndAttributes & FILE_FLAG_OVERLAPPED))
{
/* yes, nonalert is correct! apc's are not delivered
while waiting for file io to complete */
Flags |= FILE_SYNCHRONOUS_IO_NONALERT;
}
NtCreateFile间接调用IopParseDevice来创建FileObject
status = ObCreateObject( KernelMode,
IoFileObjectType,
&objectAttributes,
AccessMode,
(PVOID) NULL,
fileObjectSize,
0,
0,
(PVOID *) &fileObject );