1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
#include <ntddk.h>
#define BUFFER_SIZE 30
//
HANDLE handle;
NTSTATUS ntstatus;
IO_STATUS_BLOCK ioStatusBlock;
LARGE_INTEGER byteOffset;
CHAR buffer[BUFFER_SIZE];
size_t cb;
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
NTSTATUS NtStatus = STATUS_SUCCESS;
/////////////////////// THIS SECTION /////////////////////////////////////
UNICODE_STRING uniName;
OBJECT_ATTRIBUTES objAttr;
//////////////////////////////// \\SystemRoot\\ or C:\WINDOWS / C:|WINNT
RtlInitUnicodeString(&uniName, L"\\SystemRoot\\native.txt"); // or L"\\SystemRoot\\example.txt"
InitializeObjectAttributes(&objAttr, &uniName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
//////////////////////////////////
///////////////////////////////////
//Load the buffer (ie. contents of text file to the console)
ntstatus = ZwCreateFile(&handle,
GENERIC_READ,
&objAttr, &ioStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0);
///////////////////////////////////////
if(NT_SUCCESS(ntstatus)) {
byteOffset.LowPart = byteOffset.HighPart = 0;
ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
buffer, BUFFER_SIZE, &byteOffset, NULL);
buffer[BUFFER_SIZE-1] = '\0';
KdPrint(("%s\n", buffer));
}
ZwClose(handle);
return 0;
} |
