Closed badboycxcc closed 1 month ago
#include <ntddk.h> static void DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { UNREFERENCED_PARAMETER(DriverObject); UNREFERENCED_PARAMETER(RegistryPath); HANDLE fileTest, fileAaaa; OBJECT_ATTRIBUTES attrs; UNICODE_STRING fileNameTest, fileNameAaaa; IO_STATUS_BLOCK ioStatus; const char* content = "abcd"; ULONG contentLength = (ULONG)strlen(content); RtlInitUnicodeString(&fileNameTest, L"\\??\\C:\\test.txt"); InitializeObjectAttributes(&attrs, &fileNameTest, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL); ZwCreateFile( &fileTest, GENERIC_WRITE, &attrs, &ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF, FILE_NON_DIRECTORY_FILE, NULL, 0); ZwClose(fileTest); RtlInitUnicodeString(&fileNameAaaa, L"\\??\\C:\\aaaa.txt"); InitializeObjectAttributes(&attrs, &fileNameAaaa, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL); NTSTATUS status = ZwCreateFile( &fileAaaa, GENERIC_WRITE, &attrs, &ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF, FILE_NON_DIRECTORY_FILE, NULL, 0); if (NT_SUCCESS(status)) { status = ZwWriteFile( fileAaaa, NULL, NULL, NULL, &ioStatus, (PVOID)content, contentLength, NULL, NULL); ZwClose(fileAaaa); } else { } }