|
马上注册,结交更多好友,享用更多功能^_^
您需要 登录 才可以下载或查看,没有账号?立即注册
x
#include<ntddk.h>
//--------------------------------------------------------------------
VOID ReadPhysicalSector(unsigned long SectorStart,unsigned long SectorCount,unsigned char *p)
{
unsigned long BytesPerSector = 512;
WCHAR* name = L"//??//PHYSICALDRIVE0";//这个找了好久呀,原来要这样写的
NTSTATUS ntStatus;
HANDLE hDeviceHandle;
IO_STATUS_BLOCK IoStatusBlock;
IO_STATUS_BLOCK IoStatusBlockR;
OBJECT_ATTRIBUTES ObjectAttributesL;
UNICODE_STRING UniFileNameL;
LARGE_INTEGER ByteOffset;
RtlInitUnicodeString(&UniFileNameL,name);
InitializeObjectAttributes( &ObjectAttributesL,
&UniFileNameL,
OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
NULL,
NULL);
ntStatus = ZwCreateFile(&hDeviceHandle,
GENERIC_READ,
&ObjectAttributesL,
&IoStatusBlock,
NULL,
0,
FILE_SHARE_READ,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_ALERT,
NULL,
0);
if( NT_SUCCESS(ntStatus) )
{
DbgPrint("Open Success");
// ByteOffset.LowPart = FILE_USE_FILE_POINTER_POSITION;
// ByteOffset.HighPart = -1;不要用这两句换成下面一句,DDK误导人啊~~~~~
ByteOffset.QuadPart = SectorStart*BytesPerSector;//是这句了
ntStatus = ZwReadFile( hDeviceHandle,
NULL,
NULL,
NULL,
&IoStatusBlockR,
p,
SectorCount*BytesPerSector,
&ByteOffset,
NULL);
if( NT_SUCCESS(ntStatus) )
{
DbgPrint("Read Success");
}
}
ZwClose(hDeviceHandle);
}
//--------------------------------------------------------------------
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint(" 88 ");
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
unsigned long SectorStart = 63;//现在是读扇区啦
unsigned long SectorCount = 1;
unsigned char p[512];
int i;
DriverObject->DriverUnload = OnUnload;
DbgPrint("Hi");
ReadPhysicalSector(SectorStart ,SectorCount, p);
for(i=0;i<512;i++)
DbgPrint("%02X ",p[i]);
return STATUS_SUCCESS;
}
|
|