NTSTATUS
	FakeNtCreateSection(
	OUT PHANDLE  SectionHandle,
	IN ACCESS_MASK  DesiredAccess,
	IN POBJECT_ATTRIBUTES  ObjectAttributes,
	IN PLARGE_INTEGER  SectionSize  OPTIONAL,
	IN ULONG  Protect,
	IN ULONG  Attributes,
	IN HANDLE  FileHandle)
{

	state = ObReferenceObjectByHandle(FileHandle,
		FILE_ALL_ACCESS,
		*IoFileObjectType,
		KernelMode,
		(PVOID*)&pFileObj,
		NULL);

	if (NT_SUCCESS(state))
	{
		

		if ( Protect == PAGE_EXECUTE 
			&& Attributes == SEC_IMAGE 
			&& (int)FileHandle>= 0x80000000 )
		{

			state = GetFileFullPathByFileObj(pFileObj,szPath);
			if (!NT_SUCCESS(state))
			{
				goto pass;
			}
			//转储驱动文件
			DumpSysFile(szPath);
		}
		
		ObDereferenceObject(pFileObj);

	}
pass:
	xxxx

}