#include "ntddk.h"
NTSTATUS MyOpenFile()
{
HANDLE hFile;
NTSTATUS Status;
UNICODE_STRING usFileName;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock;
LARGE_INTEGER ReadOffset;
FILE_BASIC_INFORMATION fbi;
char strBuffer[100] = {0};
RtlInitUnicodeString(&usFileName,L"\\??\\c:\\1.txt");
memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
Status = ZwOpenFile(&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(Status))
{
KdPrint(("open file failed.Status:0x%X",Status));
return Status;
}
KdPrint(("open file success."));
RtlCopyMemory(strBuffer,"123124sdferfdsfsdsfasf",strlen("123124sdferfdsfsdsfasf"));
ReadOffset.QuadPart = 10;
Status = ZwWriteFile(hFile,NULL,NULL,NULL,&IoStatusBlock,strBuffer,strlen("123124sdferfdsfsdsfasf"),&ReadOffset,NULL);
if (!NT_SUCCESS(Status))
{
KdPrint(("Error code:%X",Status));
RtlFreeUnicodeString(&strBuffer);
RtlFreeUnicodeString(&usFileName);
ZwClose(hFile);
return Status;
}
//RtlFreeUnicodeString(&strBuffer);
//RtlFreeUnicodeString(&usFileName);
ZwClose(hFile);
return Status;
}
这个函数需要RtlFreeUnicodeString吗,我要一次次打开写入字符到文件中。怎么弄,对吗
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)