VOID FileTest()
{
// 创建文件
UNICODE_STRING FileName;
RtlInitUnicodeString(&FileName,L"\\??\\c:\\DriverFile.txt");
HANDLE hFile=NULL;
OBJECT_ATTRIBUTES objAttribute;
IO_STATUS_BLOCK io_Status_block;
InitializeObjectAttributes(&objAttribute,&FileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
if (!NT_SUCCESS(ZwCreateFile(&hFile,GENERIC_WRITE|GENERIC_READ,&objAttribute,&io_Status_block,NULL,FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,FILE_OVERWRITE_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0)))
{
KdPrint(("文件创建失败\r\n"));
}
else
{
KdPrint(("文件创建成功\r\n"));
}
// 写入文件
ANSI_STRING ansistr;
RtlInitAnsiString(&ansistr,"Hello,World");
UCHAR* pBuf=(UCHAR*)ExAllocatePool(PagedPool,ansistr.Length);
RtlCopyMemory(pBuf,ansistr.Buffer,ansistr.Length);
if (NT_SUCCESS(ZwWriteFile(hFile,NULL,NULL,NULL,&io_Status_block,pBuf,ansistr.Length,NULL,NULL)))
{
KdPrint(("文件写入成功\r\n"));
KdPrint(("写入长度=%d\r\n",io_Status_block.Information));
}
else
{
KdPrint(("文件写入失败\r\n"));
}
// 设置文件指针
LARGE_INTEGER pos;
pos.QuadPart=1i64;
if (NT_SUCCESS(ZwWriteFile(hFile,NULL,NULL,NULL,&io_Status_block,pBuf,ansistr.Length,&pos,NULL)))
{
KdPrint(("文件写入成功\r\n"));
KdPrint(("写入长度=%d\r\n",io_Status_block.Information));
}
else
{
KdPrint(("文件写入失败\r\n"));
}
ExFreePool(pBuf);
// 读取文件,首先设置要读取的位置,否则默认为zwWrite的文件末尾.
FILE_POSITION_INFORMATION fpi;
fpi.CurrentByteOffset.QuadPart = 1i64;
if(!NT_SUCCESS(ZwSetInformationFile(hFile, &io_Status_block, &fpi,sizeof(FILE_POSITION_INFORMATION), FilePositionInformation)))
{
KdPrint(("Set file pointer unsuccessfully\n"));
}
else
{
KdPrint(("Set file pointer successfully\n"));
}
CHAR* pReadBuf=(CHAR*)ExAllocatePool(PagedPool,6); // 缓冲区要比实际读取的字节数多一个'\0'结尾
RtlZeroMemory(pReadBuf,6);
if (NT_SUCCESS(ZwReadFile(hFile,NULL,NULL,NULL,&io_Status_block,pReadBuf,5,NULL,NULL)))
{
KdPrint(("读取文件成功,内容=%s,长度=%d\r\n",pReadBuf,io_Status_block.Information));
}
else
{
KdPrint(("文件读取失败\r\n"));
}
ExFreePool(pReadBuf);
// 关闭文件
if (NULL!=hFile)
{
if (NT_SUCCESS(ZwClose(hFile)))
{
KdPrint(("文件关闭成功\r\n"));
}
else
{
KdPrint(("文件关闭失败\r\n"));
}
}
InitializeObjectAttributes(&objAttribute,&FileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
if (!NT_SUCCESS(ZwCreateFile(&hFile,GENERIC_WRITE|GENERIC_READ,&objAttribute,&io_Status_block,NULL,FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,FILE_OPEN,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0)))
{
KdPrint(("文件创建失败\r\n"));
}
else
{
KdPrint(("文件创建成功\r\n"));
}
// 读取文件长度
FILE_STANDARD_INFORMATION fsi;
if (NT_SUCCESS(ZwQueryInformationFile(hFile,&io_Status_block,&fsi,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation)))
{
KdPrint(("文件长度=%u\r\n",fsi.EndOfFile.QuadPart));
}
// 读取文件名信息
FILE_NAME_INFORMATION* fni=(FILE_NAME_INFORMATION*)ExAllocatePool(PagedPool,sizeof(ULONG)+256);
RtlZeroMemory(fni,sizeof(ULONG)+256);
if (NT_SUCCESS(ZwQueryInformationFile(hFile,&io_Status_block,fni,sizeof(ULONG)+256,FileNameInformation)))
{
KdPrint(("文件名=%ws\r\n",fni->FileName));
KdPrint(("文件名长度=%u\r\n",fni->FileNameLength/sizeof(WCHAR))); // 除以2是因为文件名是WCHAR类型的
}
ExFreePool(fni);
// 关闭文件
if (NULL!=hFile)
{
if (NT_SUCCESS(ZwClose(hFile)))
{
KdPrint(("文件关闭成功\r\n"));
}
else
{
KdPrint(("文件关闭失败\r\n"));
}
}
}
内核模式下的文件操作
最新推荐文章于 2023-06-09 09:34:06 发布