21、Windows内核函数(2)Windows驱动开发详解笔记，文件操作

1、创建

ZwCreateFile

注意CreateDisposition 参数。

代码

 1 VOID CreateFileTest()
 2 {
 3 OBJECT_ATTRIBUTES objectAttributes;
 4 IO_STATUS_BLOCK iostatus;
 5 HANDLE hfile;
 6 UNICODE_STRING logFileUnicodeString;
 7  //初始化UNICODE_STRING字符串
 8  RtlInitUnicodeString( &logFileUnicodeString,
 9 L"\\??\\C:\\1.log");
10  //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
11  //初始化objectAttributes
12  InitializeObjectAttributes(&objectAttributes,
13  &logFileUnicodeString,
14 OBJ_CASE_INSENSITIVE,
15 NULL,
16 NULL );
17  //创建文件
18  NTSTATUS ntStatus = ZwCreateFile( &hfile,
19 GENERIC_WRITE,
20 &objectAttributes,
21 &iostatus,
22 NULL,
23 FILE_ATTRIBUTE_NORMAL,
24 FILE_SHARE_READ,
25 FILE_OPEN_IF,//即使存在该文件，也创建
26 FILE_SYNCHRONOUS_IO_NONALERT,
27 NULL,
28 0 );
29 if ( NT_SUCCESS(ntStatus))
30 {
31 KdPrint(("Create file succussfully!\n"));
32 }else
33 {
34 KdPrint(("Create file  unsuccessfully!\n"));
35 }
36 //文件操作
37 //.......
38 //关闭文件句柄
39 ZwClose(hfile);
40 }

2、打开

ZwOpenFile

代码

 1 OBJECT_ATTRIBUTES objectAttributes;
 2 
 3 IO_STATUS_BLOCK iostatus;
 4 
 5 HANDLE hfile;
 6 
 7 UNICODE_STRING logFileUnicodeString;
 8 
 9 //初始化UNICODE_STRING字符串
10 
11 RtlInitUnicodeString( &logFileUnicodeString,
12 
13 L"\\??\\C:\\1.log");
14 
15 //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
16 
17 //初始化objectAttributes
18 
19 InitializeObjectAttributes(&objectAttributes,
20 
21 &logFileUnicodeString,
22 
23 OBJ_CASE_INSENSITIVE,
24 
25 NULL,
26 
27 NULL );
28 
29 //创建文件
30 
31 NTSTATUS ntStatus = ZwOpenFile( &hfile,
32 
33 GENERIC_ALL,
34 
35 &objectAttributes,
36 
37 &iostatus,
38 
39 FILE_SHARE_READ|FILE_SHARE_WRITE,
40 
41 FILE_SYNCHRONOUS_IO_NONALERT);
42 
43 if ( NT_SUCCESS(ntStatus))
44 
45 {
46 
47 KdPrint(("Create file succussfully!\n"));
48 
49 }else
50 
51 {
52 
53 KdPrint(("Create file  unsuccessfully!\n"));
54 
55 }
56 
57 //文件操作
58 
59 //.......
60 
61 //关闭文件句柄
62 
63 ZwClose(hfile);

3、获取或修改文件属性

ZwSetInformationFile

ZwQueryInformationFile

4、文件的写、读操作

ZwWriteFile

ZwReadFile

代码

 1 OBJECT_ATTRIBUTES objectAttributes;
 2 IO_STATUS_BLOCK iostatus;
 3 HANDLE hfile;
 4 UNICODE_STRING logFileUnicodeString;
 5 //初始化UNICODE_STRING字符串
 6 RtlInitUnicodeString( &logFileUnicodeString,
 7 L"\\??\\C:\\1.log");
 8 //或者写成 "\\Device\\HarddiskVolume1\\1.LOG"
 9 //初始化objectAttributes
10 InitializeObjectAttributes(&objectAttributes,
11 &logFileUnicodeString,
12 OBJ_CASE_INSENSITIVE,//对大小写敏感
13 NULL,
14 NULL );
15 //创建文件
16 NTSTATUS ntStatus = ZwCreateFile( &hfile,
17 GENERIC_WRITE,
18 &objectAttributes,
19 &iostatus,
20 NULL,
21 FILE_ATTRIBUTE_NORMAL,
22 FILE_SHARE_WRITE,
23 FILE_OPEN_IF,//即使存在该文件，也创建
24 FILE_SYNCHRONOUS_IO_NONALERT,
25 NULL,
26 0 );
27 #define BUFFER_SIZE 1024
28 PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
29 //构造要填充的数据
30 RtlFillMemory(pBuffer,BUFFER_SIZE,0xAA);
31 KdPrint(("The program will write %d bytes\n",BUFFER_SIZE));
32 //写文件
33 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
34 KdPrint(("The program really wrote %d bytes\n",iostatus.Information));
35 //构造要填充的数据
36 RtlFillMemory(pBuffer,BUFFER_SIZE,0xBB);
37 KdPrint(("The program will append %d bytes\n",BUFFER_SIZE));
38 //追加数据
39 LARGE_INTEGER number;
40 number.QuadPart = 1024i64;//设置文件指针
41 //对文件进行附加写
42 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,&number,NULL);
43 KdPrint(("The program really appended %d bytes\n",iostatus.Information));
44 //关闭文件句柄
45 ZwClose(hfile);
46 ExFreePool(pBuffer);

参考：

［1］ Windows驱动开发详解

［2］ MSDN