question related to drivers
-
I have device driver and I want to write in a file from within the driver. I am using ZwCreateFile() ZwWriteFile() ZwClose() functions. When I call the InitializeObjectAttributesfunction() i do not know how should the object name look like. I mean if my file name is: D:\\status.txt or something like this: \Device\HarddiskVolume1\status.txt I want to ask now if these are the functions I should use when writting in a file from the kernel: Here is a piece of code. Can someone tell me what I do wrong?
NTSTATUS WriteStatusInFile( IN PCWSTR FileName, IN HANDLE hProcessId ) { UNICODE_STRING ObjN; OBJECT_ATTRIBUTES ObjAttrib; UNICODE_STRING ObjName; IN HANDLE hFile; IN IO_STATUS_BLOCK StatBlock,WStatBlock; RtlInitUnicodeString(&ObjN,L"\\D:\\status.txt"); InitializeObjectAttributes(&ObjAttrib,&ObjN, OBJ_KERNEL_HANDLE , NULL, NULL); ZwCreateFile(&hFile, FILE_WRITE_DATA|FILE_APPEND_DATA, &ObjAttrib, &StatBlock, 0, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_CREATE |FILE_OPEN, FILE_SEQUENTIAL_ONLY, NULL, 0 ); ZwWriteFile( hFile, NULL, NULL, NULL, &WStatBlock, L"Process Created or Terminated\n", sizeof("Process Created or Terminated\n"), NULL, NULL ); ZwClose(hFile); return WStatBlock.Status; }Thanks in advance. gabby