#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT driver)
{
UNREFERENCED_PARAMETER(driver);
HANDLE hFile;
NTSTATUS status;
OBJECT_ATTRIBUTES Obj;
UNICODE_STRING FileName = RTL_CONSTANT_STRING(L"\\??\\D:\\GoodbyeWorld.txt");
IO_STATUS_BLOCK IoStatus;
PVOID Buffer = { "Goodbye,world!" };
LARGE_INTEGER Offset = { 0 };
InitializeObjectAttributes(
&Obj,
&FileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL
);
status = ZwCreateFile(&hFile,
GENERIC_WRITE,
&Obj,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
status = ZwWriteFile(hFile,
NULL,
NULL,
NULL,
&IoStatus,
Buffer,
15,
&Offset,
NULL);
ZwClose(hFile);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
{
UNREFERENCED_PARAMETER(driver);
UNREFERENCED_PARAMETER(reg_path);
HANDLE hFile;
NTSTATUS status;
OBJECT_ATTRIBUTES Obj;
UNICODE_STRING FileName = RTL_CONSTANT_STRING(L"\\??\\D:\\HelloWorld.txt");
IO_STATUS_BLOCK IoStatus;
PVOID Buffer = {"Hello,world!"};
LARGE_INTEGER Offset = { 0 };
InitializeObjectAttributes(
&Obj,
&FileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL
);
status = ZwCreateFile(&hFile,
GENERIC_WRITE,
&Obj,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(status))
{
return status;
}
status = ZwWriteFile(hFile,
NULL,
NULL,
NULL,
&IoStatus,
Buffer,
13,
&Offset,
NULL);
if (!NT_SUCCESS(status))
{
return status;
}
ZwClose(hFile);
driver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}