内核模式 文件操作

首先   当编译驱动时发生错误：

LINK : warning LNK4044: unrecognized option '/pdbtype:sept'; ignored
Creating browse info file...
BSCMAKE: error BK1510 : corrupt .SBR file '.\sys\DriverMemory.sbr'

解决方法：

勾掉工程or项目（各版本翻译不一样）-> 设置or属性（仍然是翻译不一样）-> C/C++ -> 产生浏览信息，编译没有错误了

文件创建：

#pragma INITCODE
VOID MyCreaFile()
{
	OBJECT_ATTRIBUTES obj_attr;
	UNICODE_STRING Obj_Attr_Name;
	IO_STATUS_BLOCK iostatus;
	HANDLE hFile;
	RtlInitUnicodeString(&Obj_Attr_Name,L"\\??\\C:\\1.log");//或者写成 \\Device\\HarddiskVolume1\\1.log

	InitializeObjectAttributes(&obj_attr,&Obj_Attr_Name,OBJ_CASE_INSENSITIVE,NULL,NULL);

	NTSTATUS status = ZwCreateFile(&hFile,
		GENERIC_WRITE,
		&obj_attr,
		&iostatus,
		0,FILE_ATTRIBUTE_NORMAL
		,FILE_SHARE_READ
		,FILE_OPEN_IF,
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,0);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("创建文件失败!\n"));
	}
	else
	{
		KdPrint(("创建文件成功!\n"));
	}
	//文件操作
	ZwClose(hFile);
}

文件打开  两个方式：

#pragma INITCODE
VOID MyOpenFile()
{
	OBJECT_ATTRIBUTES obj_attr1,obj_attr2;
	UNICODE_STRING obj_attr_name1,obj_attr_name2;
	HANDLE  hFile1,hFile2;
	IO_STATUS_BLOCK iostatus1,iostatus2;

	RtlInitUnicodeString(&obj_attr_name1,L"\\??\\C:\\1.log");
	RtlInitUnicodeString(&obj_attr_name2,L"\\??\\C:\\2.log");//不能同时打开同一文件
	InitializeObjectAttributes(&obj_attr1,
		&obj_attr_name1,
		OBJ_CASE_INSENSITIVE,
		NULL,NULL);
	InitializeObjectAttributes(&obj_attr2,
		&obj_attr_name2,
		OBJ_CASE_INSENSITIVE,
		NULL,NULL);
//////////////////////////////////////////////////////////////////////////////方式1
	NTSTATUS status1 = ZwCreateFile(&hFile1,
		FILE_GENERIC_READ,
		&obj_attr1,
		&iostatus1,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_READ,
		FILE_OPEN,//打开文件，不存在 反悔错误
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,0);
//////////////////////////////////////////////////////////////////////////////方式2
	NTSTATUS status2 = ZwOpenFile(&hFile2,
		GENERIC_ALL,
		&obj_attr2,
		&iostatus2,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		FILE_SYNCHRONOUS_IO_NONALERT);
	if (!NT_SUCCESS(status1))
	{
		KdPrint(("方式1：打开文件失败"));
	}
	else
	{
		KdPrint(("方式1：打开文件成功"));
	}
	if (!NT_SUCCESS(status2))
	{
		KdPrint(("方式2：打开文件失败"));
	}
	else
	{
		KdPrint(("方式2：打开文件成功"));
	}
	ZwClose(hFile1);
	ZwClose(hFile2);
}

实验    修改文件属性：

#pragma INITCODE
VOID MyQueryInformationFile()
{
	HANDLE hFile;
	OBJECT_ATTRIBUTES obj_attr;
	UNICODE_STRING obj_attr_name;
	IO_STATUS_BLOCK io_status;

	RtlInitUnicodeString(&obj_attr_name,L"\\??\\C:\\my.log");
	InitializeObjectAttributes(&obj_attr,
		&obj_attr_name,
		OBJ_CASE_INSENSITIVE,
		NULL,NULL);


	NTSTATUS status = ZwCreateFile(&hFile,
		GENERIC_READ,
		&obj_attr,
		&io_status,
		0,
		FILE_ATTRIBUTE_NORMAL,
		0,
		FILE_OPEN,//文件不存在  报错
		FILE_SYNCHRONOUS_IO_NONALERT,
		NULL,0
		);
		if (!NT_SUCCESS(status))
		{
			KdPrint(("文件创建失败\n"));
		}
		else
			KdPrint(("文件创建成功\n"));

//////////////////////////////////////////////////////////////////////////////////获取文件信息
		FILE_STANDARD_INFORMATION fsi;
		status = ZwQueryInformationFile(hFile,
			&io_status,
			&fsi,
			sizeof(FILE_STANDARD_INFORMATION),
			FileStandardInformation);

		if (!NT_SUCCESS(status))
		{
			KdPrint(("文件获取信息失败\n"));
		}
		else
			KdPrint(("文件获取信息成功\n"));
			KdPrint(("file length: %u \n\n",fsi.EndOfFile));
///////////////////////////////////////////////////////////////////////////////////修改文件指针
		KdPrint(("修改文件指针\n"));
		FILE_POSITION_INFORMATION fpi;
		fpi.CurrentByteOffset.QuadPart = 100i64;

		status = ZwSetInformationFile(hFile,
			&io_status,
			&fpi,
			sizeof(FILE_POSITION_INFORMATION),
			FilePositionInformation);

		if (!NT_SUCCESS(status))
		{
			KdPrint(("文件设置信息失败\n"));
		}
		else
			KdPrint(("文件设置信息成功\n"));
			KdPrint(("file pointer: %u \n\n",fpi.CurrentByteOffset.QuadPart));
			//LONGLONGSHI  64位长整型整数
			//LARGE_INTEGER 是数据结构
///////////////////////////////////////////////////////////////////////////////////修改文件基础信息
			FILE_BASIC_INFORMATION fbi;

			status = ZwQueryInformationFile(hFile,&io_status,
				&fbi,
				sizeof(FILE_BASIC_INFORMATION),
				FileBasicInformation);
			
			if (!NT_SUCCESS(status))
			{
				KdPrint(("获取文件基本信息失败\n"));
			}
			else
			{
				KdPrint(("获取文件基本信息成功\n"));
				KdPrint(("文件创建时间:%u\n",fbi.CreationTime));
				KdPrint(("最后访问时间:%u\n",fbi.LastAccessTime));
				KdPrint(("文件写时间:%u\n",fbi.LastWriteTime));
				KdPrint(("最后修改时间:%u\n",fbi.ChangeTime));
				KdPrint(("文件属性:%u\n",fbi.FileAttributes));
			}	
					KdPrint(("修改信息：\n\n"));
					fbi.ChangeTime.QuadPart = 100i64;
					fbi.CreationTime.QuadPart = 100i64;

					fbi.LastAccessTime.QuadPart = 100i64;
					fbi.LastWriteTime.QuadPart = 100i64;
			status = ZwSetInformationFile(hFile,&io_status,
				&fbi,
				sizeof(FILE_BASIC_INFORMATION),
				FileBasicInformation);
			
			if (!NT_SUCCESS(status))
			{
				KdPrint(("修改信息失败\n"));
			}
			else
			{
				KdPrint(("修改信息成功\n"));
				KdPrint(("获取文件基本信息成功\n"));
				KdPrint(("文件创建时间:%u\n",fbi.CreationTime.QuadPart));
				KdPrint(("最后访问时间:%u\n",fbi.LastAccessTime.QuadPart));
				KdPrint(("文件写时间:%u\n",fbi.LastWriteTime.QuadPart));
				KdPrint(("最后修改时间:%u\n",fbi.ChangeTime.QuadPart));
				KdPrint(("文件属性:%u\n",fbi.FileAttributes));
			}

					ZwClose(hFile);

}

  碉堡了·········································································

下面是写入文本内容：

VOID MyFileStudy()//文本 写入 追加学习
{
	HANDLE hFile;
	OBJECT_ATTRIBUTES obj_attr;
	UNICODE_STRING obj_attr_name;
	IO_STATUS_BLOCK io_status;

	RtlInitUnicodeString(&obj_attr_name,L"\\??\\c:\\FileStudy.log");

	InitializeObjectAttributes(&obj_attr,&obj_attr_name,OBJ_CASE_INSENSITIVE,
		NULL,NULL);
	
	NTSTATUS status = ZwCreateFile(&hFile,GENERIC_WRITE ,&obj_attr,&io_status,
		NULL,
		FILE_ATTRIBUTE_NORMAL,
		FILE_SHARE_WRITE,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0
		);//FILE_OPEN_IF不存在   也创建文件
	if (!NT_SUCCESS(status))
	{
		KdPrint(("文件创建失败\n"));
		return;
	}
	else
		KdPrint(("文件创建成功\n"));
	//////////////////////////写入文件内容///////////////////////////////////////////////////////////

	PUCHAR pWritetofile = (PUCHAR)ExAllocatePool(PagedPool,1024);

	RtlFillMemory(pWritetofile,1024,0xAA);
	
	KdPrint(("write to the buffer %d bytes\n",1024));
	KdPrint(("buffer内容：    %s\n\n",pWritetofile));

	ZwWriteFile(hFile,NULL,NULL,NULL,&io_status,pWritetofile,1024,NULL,NULL);
	KdPrint(("write to the file %d bytes\n",io_status.Information));

	RtlFillMemory(pWritetofile,1024,0xbb);
	
	KdPrint(("the program will append %d bytes \n",1024));

	LARGE_INTEGER number;
	number.QuadPart = 1024i64;

	status = ZwWriteFile(hFile,NULL,NULL,NULL,&io_status,pWritetofile,1024,&number,NULL);
	KdPrint(("the program really appended %d bytes\n",io_status.Information));
	KdPrint(("buffer内容：    %s\n\n",pWritetofile));
	//////////////////////////查询文件内容//////////////////////////////////////////////////////////
	FILE_STANDARD_INFORMATION fsi;

	status = ZwQueryInformationFile(hFile,
		&io_status,
		&fsi,
		sizeof(FILE_STANDARD_INFORMATION),
		FileStandardInformation);
	if (NT_SUCCESS(status))
	{
		KdPrint(("现在文件大小为：%u bytes\n\n\n",fsi.EndOfFile.QuadPart));
	}
	
	ZwClose(hFile);

	ExFreePool(pWritetofile);

}