21、Windows内核函数(2)-Windows驱动开发详解笔记，文件操作
1、创建
代码
代码
3
、获取或修改文件属性
代码
ZwCreateFile
注意CreateDisposition 参数。
代码
1
VOID CreateFileTest()
2
{
3
OBJECT_ATTRIBUTES objectAttributes;
4
IO_STATUS_BLOCK iostatus;
5
HANDLE hfile;
6
UNICODE_STRING logFileUnicodeString;
7
//
初始化UNICODE_STRING字符串
8
RtlInitUnicodeString(
&
logFileUnicodeString,
9
L
"
\\??\\C:\\1.log
"
);
10
//
或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
11
//
初始化objectAttributes
12
InitializeObjectAttributes(
&
objectAttributes,
13
&
logFileUnicodeString,
14
OBJ_CASE_INSENSITIVE,
15
NULL,
16
NULL );
17
//
创建文件
18
NTSTATUS ntStatus
=
ZwCreateFile(
&
hfile,
19
GENERIC_WRITE,
20
&
objectAttributes,
21
&
iostatus,
22
NULL,
23
FILE_ATTRIBUTE_NORMAL,
24
FILE_SHARE_READ,
25
FILE_OPEN_IF,
//
即使存在该文件，也创建
26
FILE_SYNCHRONOUS_IO_NONALERT,
27
NULL,
28
0
);
29
if
( NT_SUCCESS(ntStatus))
30
{
31
KdPrint((
"
Create file succussfully!\n
"
));
32
}
else
33
{
34
KdPrint((
"
Create file unsuccessfully!\n
"
));
35
}
36
//
文件操作
37
//
.......
38
//
关闭文件句柄
39
ZwClose(hfile);
40
}
2、打开
ZwOpenFile
代码
1
OBJECT_ATTRIBUTES objectAttributes;
2
3
IO_STATUS_BLOCK iostatus;
4
5
HANDLE hfile;
6
7
UNICODE_STRING logFileUnicodeString;
8
9
//
初始化UNICODE_STRING字符串
10
11
RtlInitUnicodeString(
&
logFileUnicodeString,
12
13
L
"
\\??\\C:\\1.log
"
);
14
15
//
或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
16
17
//
初始化objectAttributes
18
19
InitializeObjectAttributes(
&
objectAttributes,
20
21
&
logFileUnicodeString,
22
23
OBJ_CASE_INSENSITIVE,
24
25
NULL,
26
27
NULL );
28
29
//
创建文件
30
31
NTSTATUS ntStatus
=
ZwOpenFile(
&
hfile,
32
33
GENERIC_ALL,
34
35
&
objectAttributes,
36
37
&
iostatus,
38
39
FILE_SHARE_READ
|
FILE_SHARE_WRITE,
40
41
FILE_SYNCHRONOUS_IO_NONALERT);
42
43
if
( NT_SUCCESS(ntStatus))
44
45
{
46
47
KdPrint((
"
Create file succussfully!\n
"
));
48
49
}
else
50
51
{
52
53
KdPrint((
"
Create file unsuccessfully!\n
"
));
54
55
}
56
57
//
文件操作
58
59
//
.......
60
61
//
关闭文件句柄
62
63
ZwClose(hfile);
ZwSetInformationFile
ZwQueryInformationFile
4、文件的写、读操作
ZwWriteFile
ZwReadFile
代码
1
OBJECT_ATTRIBUTES objectAttributes;
2
IO_STATUS_BLOCK iostatus;
3
HANDLE hfile;
4
UNICODE_STRING logFileUnicodeString;
5
//
初始化UNICODE_STRING字符串
6
RtlInitUnicodeString(
&
logFileUnicodeString,
7
L
"
\\??\\C:\\1.log
"
);
8
//
或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
9
//
初始化objectAttributes
10
InitializeObjectAttributes(
&
objectAttributes,
11
&
logFileUnicodeString,
12
OBJ_CASE_INSENSITIVE,
//
对大小写敏感
13
NULL,
14
NULL );
15
//
创建文件
16
NTSTATUS ntStatus
=
ZwCreateFile(
&
hfile,
17
GENERIC_WRITE,
18
&
objectAttributes,
19
&
iostatus,
20
NULL,
21
FILE_ATTRIBUTE_NORMAL,
22
FILE_SHARE_WRITE,
23
FILE_OPEN_IF,
//
即使存在该文件，也创建
24
FILE_SYNCHRONOUS_IO_NONALERT,
25
NULL,
26
0
);
27
#define
BUFFER_SIZE 1024
28
PUCHAR pBuffer
=
(PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
29
//
构造要填充的数据
30
RtlFillMemory(pBuffer,BUFFER_SIZE,
0xAA
);
31
KdPrint((
"
The program will write %d bytes\n
"
,BUFFER_SIZE));
32
//
写文件
33
ZwWriteFile(hfile,NULL,NULL,NULL,
&
iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
34
KdPrint((
"
The program really wrote %d bytes\n
"
,iostatus.Information));
35
//
构造要填充的数据
36
RtlFillMemory(pBuffer,BUFFER_SIZE,
0xBB
);
37
KdPrint((
"
The program will append %d bytes\n
"
,BUFFER_SIZE));
38
//
追加数据
39
LARGE_INTEGER number;
40
number.QuadPart
=
1024i64;
//
设置文件指针
41
//
对文件进行附加写
42
ZwWriteFile(hfile,NULL,NULL,NULL,
&
iostatus,pBuffer,BUFFER_SIZE,
&
number,NULL);
43
KdPrint((
"
The program really appended %d bytes\n
"
,iostatus.Information));
44
//
关闭文件句柄
45
ZwClose(hfile);
46
ExFreePool(pBuffer);
参考：
［1］ Windows驱动开发详解
［2］ MSDN