NTSTATUS HookZwCreateFile(OUT PHANDLE FileHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    IN PLARGE_INTEGER AllocationSize OPTIONAL,
    IN ULONG FileAttributes,
    IN ULONG ShareAccess,
    IN ULONG CreateDisposition,
    IN ULONG CreateOptions,
    IN PVOID EaBuffer OPTIONAL,
    IN ULONG EaLength) 
{ 
	UNICODE_STRING Path;
	RtlInitUnicodeString(&Path,L"\\??\\D:\\1.txt");
	if(RtlCompareUnicodeString(&Path,ObjectAttributes->ObjectName,TRUE)==0);
	{
		dprintf("%wZ",&Path);
		return STATUS_SUCCESS;
	}
	return RealZwCreateFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,
	AllocationSize OPTIONAL,FileAttributes,ShareAccess,CreateDisposition,CreateOptions,
	EaBuffer OPTIONAL,EaLength);	
} 

[课程]Linux pwn 探索篇！