question related to drivers
-
I have device driver and I want to write in a file from within the driver. I am using ZwCreateFile() ZwWriteFile() ZwClose() functions. When I call the InitializeObjectAttributesfunction() i do not know how should the object name look like. I mean if my file name is: D:\\status.txt or something like this: \Device\HarddiskVolume1\status.txt I want to ask now if these are the functions I should use when writting in a file from the kernel: Here is a piece of code. Can someone tell me what I do wrong? NTSTATUS WriteStatusInFile( IN PCWSTR FileName, IN HANDLE hProcessId ) { UNICODE_STRING ObjN; OBJECT_ATTRIBUTES ObjAttrib; UNICODE_STRING ObjName; IN HANDLE hFile; IN IO_STATUS_BLOCK StatBlock,WStatBlock; RtlInitUnicodeString(&ObjN,L"\\D:\\status.txt"); InitializeObjectAttributes(&ObjAttrib,&ObjN, OBJ_KERNEL_HANDLE , NULL, NULL); ZwCreateFile(&hFile, FILE_WRITE_DATA|FILE_APPEND_DATA, &ObjAttrib, &StatBlock, 0, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_CREATE |FILE_OPEN, FILE_SEQUENTIAL_ONLY, NULL, 0 ); ZwWriteFile( hFile, NULL, NULL, NULL, &WStatBlock, L"Process Created or Terminated\n", sizeof("Process Created or Terminated\n"), NULL, NULL ); ZwClose(hFile); return WStatBlock.Status; } Thanks in advance. gabby
-
I have device driver and I want to write in a file from within the driver. I am using ZwCreateFile() ZwWriteFile() ZwClose() functions. When I call the InitializeObjectAttributesfunction() i do not know how should the object name look like. I mean if my file name is: D:\\status.txt or something like this: \Device\HarddiskVolume1\status.txt I want to ask now if these are the functions I should use when writting in a file from the kernel: Here is a piece of code. Can someone tell me what I do wrong? NTSTATUS WriteStatusInFile( IN PCWSTR FileName, IN HANDLE hProcessId ) { UNICODE_STRING ObjN; OBJECT_ATTRIBUTES ObjAttrib; UNICODE_STRING ObjName; IN HANDLE hFile; IN IO_STATUS_BLOCK StatBlock,WStatBlock; RtlInitUnicodeString(&ObjN,L"\\D:\\status.txt"); InitializeObjectAttributes(&ObjAttrib,&ObjN, OBJ_KERNEL_HANDLE , NULL, NULL); ZwCreateFile(&hFile, FILE_WRITE_DATA|FILE_APPEND_DATA, &ObjAttrib, &StatBlock, 0, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_CREATE |FILE_OPEN, FILE_SEQUENTIAL_ONLY, NULL, 0 ); ZwWriteFile( hFile, NULL, NULL, NULL, &WStatBlock, L"Process Created or Terminated\n", sizeof("Process Created or Terminated\n"), NULL, NULL ); ZwClose(hFile); return WStatBlock.Status; } Thanks in advance. gabby
This is how its done. Its a code chunk out of an ndis driver but its the same as what you wil want: OBJECT_ATTRIBUTES ObjectAttributes; IO_STATUS_BLOCK IoStatusBlock; UNICODE_STRING ObjectName; RtlInitUnicodeString(&ObjectName, L"\\DosDevices\\C:\\R_NDIS.txt"); InitializeObjectAttributes(&ObjectAttributes, &ObjectName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = ZwCreateFile( &hfile, GENERIC_WRITE, &ObjectAttributes, &IoStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT, NULL, 0); if(IoStatusBlock.Status != STATUS_SUCCESS) { DBGPRINT(ERROR, ("Couldn't create file\n")); } else { /// write data... Nunc est bibendum!