#include<ntddk.h>
#include<wdm.h>
#include <assert.h>
VOID Unload(PDRIVER_OBJECT obj)
{
       DbgPrint("驱动已卸载");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT obj, PUNICODE_STRING str)
{
	obj->DriverUnload = Unload;

	HANDLE hFile=NULL;

	OBJECT_ATTRIBUTES objAttribut;
	UNICODE_STRING strAttrbutName;
	IO_STATUS_BLOCK szIoStatuBlock;

	WCHAR wcFileName[1024] = { 0 };
	WCHAR wcFileNameRet[1024] = L"\\??\\c:\\新建文本文档.cpp";
	RtlInitUnicodeString(&strAttrbutName, wcFileNameRet);
	InitializeObjectAttributes(&objAttribut, &strAttrbutName, OBJ_CASE_INSENSITIVE, NULL,NULL);



	

	ZwOpenFile(&hFile, FILE_READ_ATTRIBUTES, &objAttribut, &szIoStatuBlock, 1 | 4, (ULONG)NULL);
	DbgPrint("%#x\n", hFile);
	//UCHAR cBuff[10] = { 0 };
	FILE_STANDARD_INFORMATION fsi;
	ZwQueryInformationFile(hFile, &szIoStatuBlock, &fsi, sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation);
	PVOID cBuff=ExAllocatePool(PagedPool, 10);
	DbgPrint("返回值：%#x\n", ZwReadFile(hFile, NULL, NULL, NULL, &szIoStatuBlock, cBuff, 0x4,&(fsi.EndOfFile), NULL));
	DbgPrint("%#x\n", cBuff);
	ZwClose(hFile);
	return STATUS_SUCCESS;
}