内核模式下的文件操作

VOID FileTest()
{
	// 创建文件
	UNICODE_STRING FileName;
	RtlInitUnicodeString(&FileName,L"\\??\\c:\\DriverFile.txt");
	HANDLE hFile=NULL;
	OBJECT_ATTRIBUTES objAttribute;
	IO_STATUS_BLOCK io_Status_block;
	InitializeObjectAttributes(&objAttribute,&FileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
	if (!NT_SUCCESS(ZwCreateFile(&hFile,GENERIC_WRITE|GENERIC_READ,&objAttribute,&io_Status_block,NULL,FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ,FILE_OVERWRITE_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0)))
	{
		KdPrint(("文件创建失败\r\n"));
	}
	else
	{
		KdPrint(("文件创建成功\r\n"));
	}

	// 写入文件
	ANSI_STRING ansistr;
	RtlInitAnsiString(&ansistr,"Hello,World");
	UCHAR* pBuf=(UCHAR*)ExAllocatePool(PagedPool,ansistr.Length);
	RtlCopyMemory(pBuf,ansistr.Buffer,ansistr.Length);
	if (NT_SUCCESS(ZwWriteFile(hFile,NULL,NULL,NULL,&io_Status_block,pBuf,ansistr.Length,NULL,NULL)))
	{
		KdPrint(("文件写入成功\r\n"));
		KdPrint(("写入长度=%d\r\n",io_Status_block.Information));
	}
	else
	{
		KdPrint(("文件写入失败\r\n"));
	}

	// 设置文件指针
	LARGE_INTEGER pos;
	pos.QuadPart=1i64;
	if (NT_SUCCESS(ZwWriteFile(hFile,NULL,NULL,NULL,&io_Status_block,pBuf,ansistr.Length,&pos,NULL)))
	{
		KdPrint(("文件写入成功\r\n"));
		KdPrint(("写入长度=%d\r\n",io_Status_block.Information));
	}
	else
	{
		KdPrint(("文件写入失败\r\n"));
	}

	ExFreePool(pBuf);

	// 读取文件,首先设置要读取的位置,否则默认为zwWrite的文件末尾.
	FILE_POSITION_INFORMATION fpi;
	fpi.CurrentByteOffset.QuadPart = 1i64;
	if(!NT_SUCCESS(ZwSetInformationFile(hFile, &io_Status_block, &fpi,sizeof(FILE_POSITION_INFORMATION),  FilePositionInformation)))
	{
		KdPrint(("Set file pointer unsuccessfully\n"));
	}
	else
	{
		KdPrint(("Set file pointer successfully\n"));	
	}
	CHAR* pReadBuf=(CHAR*)ExAllocatePool(PagedPool,6);	// 缓冲区要比实际读取的字节数多一个'\0'结尾
	RtlZeroMemory(pReadBuf,6);
	if (NT_SUCCESS(ZwReadFile(hFile,NULL,NULL,NULL,&io_Status_block,pReadBuf,5,NULL,NULL)))
	{
		KdPrint(("读取文件成功,内容=%s,长度=%d\r\n",pReadBuf,io_Status_block.Information));
	}
	else
	{
		KdPrint(("文件读取失败\r\n"));
	}
	ExFreePool(pReadBuf);

	// 关闭文件
	if (NULL!=hFile)
	{
		if (NT_SUCCESS(ZwClose(hFile)))
		{
			KdPrint(("文件关闭成功\r\n"));
		}
		else
		{
			KdPrint(("文件关闭失败\r\n"));
		}
	}

	InitializeObjectAttributes(&objAttribute,&FileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
	if (!NT_SUCCESS(ZwCreateFile(&hFile,GENERIC_WRITE|GENERIC_READ,&objAttribute,&io_Status_block,NULL,FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ,FILE_OPEN,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0)))
	{
		KdPrint(("文件创建失败\r\n"));
	}
	else
	{
		KdPrint(("文件创建成功\r\n"));
	}

	// 读取文件长度
	FILE_STANDARD_INFORMATION fsi;
	if (NT_SUCCESS(ZwQueryInformationFile(hFile,&io_Status_block,&fsi,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation)))
	{
		KdPrint(("文件长度=%u\r\n",fsi.EndOfFile.QuadPart));
	}

	// 读取文件名信息
	FILE_NAME_INFORMATION* fni=(FILE_NAME_INFORMATION*)ExAllocatePool(PagedPool,sizeof(ULONG)+256);
	RtlZeroMemory(fni,sizeof(ULONG)+256);
	if (NT_SUCCESS(ZwQueryInformationFile(hFile,&io_Status_block,fni,sizeof(ULONG)+256,FileNameInformation)))
	{
		KdPrint(("文件名=%ws\r\n",fni->FileName));
		KdPrint(("文件名长度=%u\r\n",fni->FileNameLength/sizeof(WCHAR)));	// 除以2是因为文件名是WCHAR类型的
	}
	ExFreePool(fni);
	// 关闭文件
	if (NULL!=hFile)
	{
		if (NT_SUCCESS(ZwClose(hFile)))
		{
			KdPrint(("文件关闭成功\r\n"));
		}
		else
		{
			KdPrint(("文件关闭失败\r\n"));
		}
	}
}