BOOL WriteFile(

    HANDLE hFile,        // handle to file to write to
    LPCVOID lpBuffer,        // pointer to data to write to file
    DWORD nNumberOfBytesToWrite,        // number of bytes to write
    LPDWORD lpNumberOfBytesWritten,        // pointer to number of bytes written
    LPOVERLAPPED lpOverlapped         // pointer to structure needed for overlapped I/O
   );
参数：lpNumberOfBytesWritten的MSDN解释:
lpNumberOfBytesWritten
Pointer to the number of bytes written by this function call. WriteFile sets this value to zero before doing any work or error checking.
Windows NT: If lpOverlapped is NULL, lpNumberOfBytesWritten cannot be NULL.

Windows NT: If lpOverlapped is not NULL, lpNumberOfBytesWritten can be NULL. If this is an overlapped write operation, you can get the number of bytes written by calling GetOverlappedResult. If hFile is associated with an I/O completion port, you can get the number of bytes written by calling GetQueuedCompletionStatus.

Windows 95 and Windows 98: This parameter cannot be NULL
是不是如果lpOverlapped 参数为0，lpNumberOfBytesWritten就不可以为0，但是为什么又说WriteFile sets this value to zero before doing any work or error checking？(汗，估计我的外语有问题)

[课程]Linux pwn 探索篇！