1 NTSTATUS Status ;
2 HANDLE fhandle ;
3 UNICODE_STRING ConfigFileName ;
4 OBJECT_ATTRIBUTES objAttr ;
5 IO_STATUS_BLOCK ioStatusBlock ;
6 FILE_STANDARD_INFORMATION FileInfo ;
7 LONG BytesRead ;
8 UCHAR *buf = NULL ;
9
10 RtlInitUnicodeString( &ConfigFileName, FilePath ) ;
11 InitializeObjectAttributes(
12 &objAttr,
13 &ConfigFileName,
14 OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
15 NULL,
16 NULL ) ;
17
18 Status = ZwCreateFile(
19 &fhandle ,
20 SYNCHRONIZE | FILE_READ_DATA,
21 &objAttr,
22 &ioStatusBlock,
23 NULL,
24 FILE_ATTRIBUTE_NORMAL,
25 0,
26 FILE_OPEN_IF,
27 FILE_SYNCHRONOUS_IO_NONALERT,
28 NULL,
29 0
30 ) ;
31
32 if( !NT_SUCCESS(Status) )
33 {
34 DbgPrint("Create file filed \n") ;
35 *BufferAddress = NULL ;
36 *BufferSize = 0 ;
37 return ;
38 }
39
40 Status = ZwQueryInformationFile(fhandle,
41 &ioStatusBlock,
42 &FileInfo,
43 sizeof(FILE_STANDARD_INFORMATION),
44 FileStandardInformation);
45
46 //注意 这里只取了低32位.一般文件大不过4G
47 BytesRead = FileInfo.EndOfFile.LowPart ;
48 buf = ExAllocatePool(PagedPool , BytesRead) ;
49 //NdisAllocateMemory(&buf,BytesRead,TAG);
50
51 ZwReadFile(
52 fhandle ,
53 NULL ,
54 NULL ,
55 NULL ,
56 &ioStatusBlock ,
57 buf ,
58 BytesRead ,
59 NULL ,
60 NULL
61 ) ;
62
63 *BufferAddress = buf ;
64 *BufferSize = BytesRead ;
65 ZwClose(fhandle) ;
这个功能只不过是在内核下分配个内存 然后把文件内容读到内存中
要记得释放空间啊 我的代码中没释放分配的内存