1

最新推荐文章于 2022-12-30 11:19:35 发布

zapline

最新推荐文章于 2022-12-30 11:19:35 发布

阅读量433

点赞数

文章标签： attributes null file integer string io

本文链接：https://blog.csdn.net/zapline/article/details/6471366

版权

NTSTATUS save(PUNICODE_STRING pData, PUNICODE_STRING pFilename)
{
NTSTATUS ns;
HANDLE hFile;

OBJECT_ATTRIBUTES obj_attributes;
IO_STATUS_BLOCK io_sb;
LARGE_INTEGER offset = {0};

InitializeObjectAttributes(
  &obj_attributes,
  pFilename,
  OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
  NULL,
  NULL);

ns = ZwCreateFile(
  &hFile,
  GENERIC_WRITE,
  &obj_attributes,
  &io_sb,
  NULL,
  FILE_ATTRIBUTE_NORMAL,
  FILE_SHARE_READ,
  FILE_OPEN_IF,
  FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
  NULL,
  NULL);
if ( !NT_SUCCESS(ns) )
{
  DbgPrint("zcf fail!/r/n");
  return ns;
}

ns = ZwWriteFile(
  hFile,
  NULL,
  NULL,
  NULL,
  &io_sb,
  pData->Buffer,
  pData->Length,
  &offset,
  NULL);
if ( !NT_SUCCESS(ns) )
{
  DbgPrint("zwf fail!/r/n");
  return ns;
}

ns = ZwClose(hFile);
if ( !NT_SUCCESS(ns) )
{
DbgPrint("zc fail!/r/n");
return ns;
}
return ns;
}