我在驱动里是这样写的：

CCOUNTED_UNICODE_STRING        "\\Device\\AnitSoutdown", g_usDeviceName, 4 ;驱动程序名称

CCOUNTED_UNICODE_STRING        "\\??\\AnitSoutdown", g_usSymbolicLinkName, 4;符号连接名称

在应用层：
invoke GetFullPathName ,CTEXT("AnitSoutdown.sys"), sizeof DriverPath, addr DriverPath, 0
            
            invoke SteupDrv,addr DriverPath,CTEXT("AnitSoutdown"),CTEXT("AnitSoutdown"),CTEXT("\\AnitSoutdown")
            
            .if eax==-1
                   
                    invoke MessageBox,0,addr DriverPath,CTEXT("安装失败") ,MB_ICONERROR+MB_OK
                   
            .endif

invoke SteupDrv,addr DriverPath,CTEXT("AnitSoutdown"),CTEXT("AnitSoutdown"),CTEXT("\\AnitSoutdown")

SteupDrv proc lpBinaryPathName,lpServeName,lpDisplayName,lpLinkName

LOCAL hSCManager,hService
invoke OpenSCManager,0,0,SC_MANAGER_CREATE_SERVICE
.if eax==0
mov eax ,-1
ret
.endif

mov hSCManager,eax

invoke CreateService,hSCManager,lpServeName,lpDisplayName,SERVICE_START, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE, lpBinaryPathName, 0, 0, 0, 0, 0
.if eax==0

invoke OpenService ,hSCManager, lpServeName, SERVICE_START

.if eax==0
invoke CloseServiceHandle ,hSCManager
mov eax ,-1
ret
.endif


.endif
mov hService,eax

invoke StartService ,hService, 0, 0
invoke CloseServiceHandle ,hService
invoke CloseServiceHandle ,hSCManager

invoke CreateFile ,lpLinkName, GENERIC_READ + GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0

ret

SteupDrv endp

为什么总是提示安装失败，发现是在

invoke CreateFile ,lpLinkName, GENERIC_READ + GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0

这里失败的，那位大侠帮忙分析下啊，谢谢！

[课程]FART 脱壳王！加量不加价！FART作者讲授！