1、创建
代码
代码
3、获取或修改文件属性
代码
ZwCreateFile
注意CreateDisposition 参数。
代码
1 VOID CreateFileTest()
2 {
3 OBJECT_ATTRIBUTES objectAttributes;
4 IO_STATUS_BLOCK iostatus;
5 HANDLE hfile;
6 UNICODE_STRING logFileUnicodeString;
7 //初始化UNICODE_STRING字符串
8 RtlInitUnicodeString( &logFileUnicodeString,
9 L"\\??\\C:\\1.log");
10 //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
11 //初始化objectAttributes
12 InitializeObjectAttributes(&objectAttributes,
13 &logFileUnicodeString,
14 OBJ_CASE_INSENSITIVE,
15 NULL,
16 NULL );
17 //创建文件
18 NTSTATUS ntStatus = ZwCreateFile( &hfile,
19 GENERIC_WRITE,
20 &objectAttributes,
21 &iostatus,
22 NULL,
23 FILE_ATTRIBUTE_NORMAL,
24 FILE_SHARE_READ,
25 FILE_OPEN_IF,//即使存在该文件，也创建
26 FILE_SYNCHRONOUS_IO_NONALERT,
27 NULL,
28 0 );
29 if ( NT_SUCCESS(ntStatus))
30 {
31 KdPrint(("Create file succussfully!\n"));
32 }else
33 {
34 KdPrint(("Create file unsuccessfully!\n"));
35 }
36 //文件操作
37 //.......
38 //关闭文件句柄
39 ZwClose(hfile);
40 }
2、打开
ZwOpenFile
代码
1 OBJECT_ATTRIBUTES objectAttributes;
2
3 IO_STATUS_BLOCK iostatus;
4
5 HANDLE hfile;
6
7 UNICODE_STRING logFileUnicodeString;
8
9 //初始化UNICODE_STRING字符串
10
11 RtlInitUnicodeString( &logFileUnicodeString,
12
13 L"\\??\\C:\\1.log");
14
15 //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
16
17 //初始化objectAttributes
18
19 InitializeObjectAttributes(&objectAttributes,
20
21 &logFileUnicodeString,
22
23 OBJ_CASE_INSENSITIVE,
24
25 NULL,
26
27 NULL );
28
29 //创建文件
30
31 NTSTATUS ntStatus = ZwOpenFile( &hfile,
32
33 GENERIC_ALL,
34
35 &objectAttributes,
36
37 &iostatus,
38
39 FILE_SHARE_READ|FILE_SHARE_WRITE,
40
41 FILE_SYNCHRONOUS_IO_NONALERT);
42
43 if ( NT_SUCCESS(ntStatus))
44
45 {
46
47 KdPrint(("Create file succussfully!\n"));
48
49 }else
50
51 {
52
53 KdPrint(("Create file unsuccessfully!\n"));
54
55 }
56
57 //文件操作
58
59 //.......
60
61 //关闭文件句柄
62
63 ZwClose(hfile);
ZwSetInformationFile
ZwQueryInformationFile
4、文件的写、读操作
ZwWriteFile
ZwReadFile
代码
1 OBJECT_ATTRIBUTES objectAttributes;
2 IO_STATUS_BLOCK iostatus;
3 HANDLE hfile;
4 UNICODE_STRING logFileUnicodeString;
5 //初始化UNICODE_STRING字符串
6 RtlInitUnicodeString( &logFileUnicodeString,
7 L"\\??\\C:\\1.log");
8 //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
9 //初始化objectAttributes
10 InitializeObjectAttributes(&objectAttributes,
11 &logFileUnicodeString,
12 OBJ_CASE_INSENSITIVE,//对大小写敏感
13 NULL,
14 NULL );
15 //创建文件
16 NTSTATUS ntStatus = ZwCreateFile( &hfile,
17 GENERIC_WRITE,
18 &objectAttributes,
19 &iostatus,
20 NULL,
21 FILE_ATTRIBUTE_NORMAL,
22 FILE_SHARE_WRITE,
23 FILE_OPEN_IF,//即使存在该文件，也创建
24 FILE_SYNCHRONOUS_IO_NONALERT,
25 NULL,
26 0 );
27 #define BUFFER_SIZE 1024
28 PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
29 //构造要填充的数据
30 RtlFillMemory(pBuffer,BUFFER_SIZE,0xAA);
31 KdPrint(("The program will write %d bytes\n",BUFFER_SIZE));
32 //写文件
33 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
34 KdPrint(("The program really wrote %d bytes\n",iostatus.Information));
35 //构造要填充的数据
36 RtlFillMemory(pBuffer,BUFFER_SIZE,0xBB);
37 KdPrint(("The program will append %d bytes\n",BUFFER_SIZE));
38 //追加数据
39 LARGE_INTEGER number;
40 number.QuadPart = 1024i64;//设置文件指针
41 //对文件进行附加写
42 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,&number,NULL);
43 KdPrint(("The program really appended %d bytes\n",iostatus.Information));
44 //关闭文件句柄
45 ZwClose(hfile);
46 ExFreePool(pBuffer);
参考：
［1］ Windows驱动开发详解
［2］ MSDN