驅動寫文件列子

#include <ntddk.h>


NTSTATUS Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unloaded!");
	return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
{
	DbgPrint("Driver Entry");
	driver->DriverUnload = Unload;

	PVOID	buffer;
	buffer = ExAllocatePoolWithTag(PagedPool, 100, "lxw");
	if (!buffer){
		DbgPrint("Alllocate Failed");
	}
	memset(buffer, 0, 100);
	memcpy(buffer, "hello PagedPool",15);
	DbgPrint("%s\n", buffer);
	
	//-----------------------------------
	OBJECT_ATTRIBUTES object;
	IO_STATUS_BLOCK io;
	HANDLE  hFile;
	UNICODE_STRING  log;
	RtlInitUnicodeString(&log, L"\\??\\C:\\1.log");
	InitializeObjectAttributes(&object, &log, OBJ_CASE_INSENSITIVE, NULL, NULL);
	NTSTATUS status = ZwCreateFile(&hFile,
		GENERIC_WRITE,
		&object,
		&io,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_WRITE,
		FILE_OPEN_IF,
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,
		0);
	if (!NT_SUCCESS(status)){
		DbgPrint("Open File Failed");
		return STATUS_SUCCESS;
	}
	ZwWriteFile(hFile, NULL, NULL, NULL, &io, buffer, 15, NULL, NULL);
	DbgPrint("WriteByte:%d\n", io.Information);

	ExFreePoolWithTag(buffer, "lxw");
	ZwClose(hFile);
	//----------------------------------------------------------
	return STATUS_SUCCESS;

}