易语言文件磁盘驱动源码

文件磁盘驱动易语言源码系统结构:Raw_DriverEntry,Raw_FileDiskUnload,Raw_FileDiskCreateClose,Raw_FileDiskReadWrite,Raw_FileDiskDeviceControl,Raw_FileDiskThread,Raw_OnApc_ReadWriteEnd,CallbackInit,CallbackUnInit,MAKE_QWORD,MAKE_QWORD_2,GET_HIGHT_DWORD,写到内存_整数,写到内存偏移_整数,取指针内容_整数,浮点寄存器精度复位,设置浮点控制字寄存器,取变量地址_整数,取变量地址_字节集,kmalloc,kfree,malloc,free,NT_SUCCESS,KdPrint,ExAllocatePool,InitializeObjectAttributes,MyCreateAndInit_ListHead,MyFree_ListHead,MyCreateAndInit_KSpinLock,MyFree_KSpinLock,SeDeleteClientSecurity,ARGUMENT_PRESENT,PsDereferenceImpersonationToken,PsDereferencePrimaryToken,ObDereferenceObject,IoCompleteRequest,ExInterlockedInsertTailList,ExInterlockedRemoveHeadList,SetIrpIoStatus,IoMarkIrpPending,IrpGetSystemBuffer,IrpGetMdlAddress,IoGetCurrentIrpStackLocation,PsGetCurrentThread,MmGetSystemAddressForMdlSafe,DriverEntry,FileDiskCreateDevice,StopDeviceObject,FileDiskUnload,FileDiskDeleteDevice,FileDiskCreateClose,FileDiskReadWrite,InsertPendingIrp,FileDiskDeviceControl,getname,FileDiskThread,OnThreadMessage,OnApc_ReadWriteEnd,FileDiskOpenFile,FileDiskCloseFile,Init,UnInit,OnFree,ADD_PUNICODE_STRING,L,U,PU,PU_,InitVector,UnInitVector,OnFree,OnCreate,clear,push_back,CopyTo_DRIVER_OBJECT,CopyTo_OPEN_FILE_INFORMATION,CopyFrom_OPEN_FILE_INFORMATION,CopyFrom_DRIVER_OBJECT,CopyTo_UNICODE_STRING,CopyFrom_UNICODE_STRING,CopyFrom_DEVICE_EXTENSION,CopyFrom_DISK_GEOMETRY,CopyFrom_GET_LENGTH_INFORMATION,CopyFrom_PARTITION_INFORMATION,CopyFrom_PARTITION_INFORMATION_EX,CopyFrom_CDROM_TOC,CopyTo_VERIFY_INFORMATION,CopyTo_SECURITY_CLIENT_CONTEXT,CopyTo_DEVICE_EXTENSION,CopyTo_IRP,CopyTo_IO_STACK_LOCATION,CopyFrom_IRP,CopyTo_IO_STATUS_BLOCK,CopyTo_MDL,CopyTo_DEVICE_OBJECT,CopyFrom_DEVICE_OBJECT,ExFreePool,ExAllocatePoolWithTag,PsRevertToSelf,SeCreateClientSecurity,SeImpersonateClient,SeTokenType,sizeof_xx,RtlCopyUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeStringToString,RtlQueryRegistryValues,DbgPrint,DbgPrint_1,DbgPrint_2s,DbgPrint_2,DbgPrint_3,DbgPrint_4,ZwCreateDirectoryObject,ZwMakeTemporaryObject,ZwClose,memcmp,memmove,memcpy,memset,swprintf,RtlInitAnsiString,RtlInitAnsiString_Ptr,RtlInitUnicodeString,RtlFreeUnicodeString_ptr,RtlFreeUnicodeString,RtlAnsiStringToUnicodeString_ptr,RtlAnsiStringToUnicodeString_uptr,wcslen,strlen,IoDeleteDevice,IoCreateDevice,KeSetEvent_Ptr,KeWaitForSingleObject,ObfDereferenceObject,KeInitializeSpinLock_ptr,KeInitializeEvent,PsCreateSystemThread,IofCompleteRequest,ExfInterlockedInsertTailList,ExfInterlockedRemoveHeadList,KeGetCurrentThread,ObReferenceObjectByHandle,PsTerminateSystemThread,KeSetPriorityThread,MmMapLockedPagesSpecifyCache,ZwReadFile,ZwWriteFile,ZwCreateFile,ZwCreateFile2,ZwSetInformationFile,ZwQueryInformationFile_Basic,ZwQueryInformationFile_Stand,ZwQueryInformationFile_Align,IoCreateSynchronizationEvent,KeResetEvent, ======entry || ||------_启动子程序 || ||------_临时子程序 || ||------Raw_DriverEntry || ||------Raw_FileDiskUnload || ||------Raw_FileDiskCreateClose || ||------Raw_FileDiskReadWrite || ||------Raw_FileDiskDeviceControl || ||------Raw_FileDiskThread || ||------Raw_OnApc_ReadWriteEnd || || ======helper || ||------CallbackInit || ||------CallbackUnInit || ||------MAKE_QWORD || ||------MAKE_QWORD_2 || ||------GET_HIGHT_DWORD || ||------写到内存_整数 || ||------写到内存偏移_整数 || ||------取指针内容_整数 || ||------浮点寄存器精度复位 || ||------设置浮点控制字寄存器 || ||------取变量地址_整数 || ||------取变量地址_字节集 || ||------kmalloc || ||------kfree || ||------malloc || ||------free || ||------NT_SUCCESS || ||------KdPrint || ||------ExAllocatePool || ||------InitializeObjectAttributes || ||------MyCreateAndInit_ListHead || ||------MyFree_ListHead || ||------MyCreateAndInit_KSpinLock || ||------MyFree_KSpinLock || ||------SeDeleteClientSecurity || ||------ARGUMENT_PRESENT || ||------PsDereferenceImpersonationToken || ||------PsDereferencePrimaryToken || ||------ObDereferenceObject || ||------IoCompleteRequest || ||------ExInterlockedInsertTailList || ||------ExInterlockedRemoveHeadList || ||------SetIrpIoStatus || ||------IoMarkIrpPending || ||------IrpGetSystemBuffer || ||------IrpGetMdlAddress || ||------IoGetCurrentIrpStackLocation || ||------PsGetCurrentThread || ||------MmGetSystemAddressForMdlSafe || || ======main || ||------DriverEntry || ||------FileDiskCreateDevice || ||------StopDeviceObject || ||------FileDiskUnload || ||------FileDiskDeleteDevice || ||------FileDiskCreateClose || ||------FileDiskReadWrite || ||------InsertPendingIrp || ||------FileDiskDeviceControl || ||------getname || ||------FileDiskThread || ||------OnThreadMessage || ||------OnApc_ReadWriteEnd || ||------FileDiskOpenFile || ||------FileDiskCloseFile || || ======CStackUnicode || ||------_初始化 || ||------_销毁 || ||------Init || ||------UnInit || ||------OnFree || ||------ADD_PUNICODE_STRING || ||------L || ||------U || ||------PU || ||------PU_ || || ======CVector || ||------InitVector || ||------UnInitVector || ||------OnFree || ||------OnCreate || ||------clear || ||------push_back || || ======调用的Dll || ||---[dll]------CopyTo_DRIVER_OBJECT || ||---[dll]------CopyTo_OPEN_FILE_INFORMATION || ||---[dll]------CopyFrom_OPEN_FILE_INFORMATION || ||---[dll]------CopyFrom_DRIVER_OBJECT || ||---[dll]------CopyTo_UNICODE_STRING || ||---[dll]------CopyFrom_UNICODE_STRING || ||---[dll]------CopyFrom_DEVICE_EXTENSION || ||---[dll]------CopyFrom_DISK_GEOMETRY || ||---[dll]------CopyFrom_GET_LENGTH_INFORMATION || ||---[dll]------CopyFrom_PARTITION_INFORMATION || ||---[dll]------CopyFrom_PARTITION_INFORMATION_EX || ||---[dll]------CopyFrom_CDROM_TOC || ||---[dll]------CopyTo_VERIFY_INFORMATION || ||---[dll]------CopyTo_SECURITY_CLIENT_CONTEXT || ||---[dll]------CopyTo_DEVICE_EXTENSION || ||---[dll]------CopyTo_IRP || ||---[dll]------CopyTo_IO_STACK_LOCATION || ||---[dll]------CopyFrom_IRP || ||---[dll]------CopyTo_IO_STATUS_BLOCK || ||---[dll]------CopyTo_MDL || ||---[dll]------CopyTo_DEVICE_OBJECT || ||---[dll]------CopyFrom_DEVICE_OBJECT || ||---[dll]------ExFreePool || ||---[dll]------ExAllocatePoolWithTag || ||---[dll]------PsRevertToSelf || ||---[dll]------SeCreateClientSecurity || ||---[dll]------SeImpersonateClient || ||---[dll]------SeTokenType || ||---[dll]------sizeof_xx || ||---[dll]------RtlCopyUnicodeString || ||---[dll]------RtlAppendUnicodeToString || ||---[dll]------RtlAppendUnicodeStringToString || ||---[dll]------RtlQueryRegistryValues || ||---[dll]------DbgPrint || ||---[dll]------DbgPrint_1 || ||---[dll]------DbgPrint_2s || ||---[dll]------DbgPrint_2 || ||---[dll]------DbgPrint_3 || ||---[dll]------DbgPrint_4 || ||---[dll]------ZwCreateDirectoryObject || ||---[dll]------ZwMakeTemporaryObject || ||---[dll]------ZwClose || ||---[dll]------memcmp || ||---[dll]------memmove || ||---[dll]------memcpy || ||---[dll]------memset || ||---[dll]------swprintf || ||---[dll]------RtlInitAnsiString || ||---[dll]------RtlInitAnsiString_Ptr || ||---[dll]------RtlInitUnicodeString || ||---[dll]------RtlFreeUnicodeString_ptr || ||---[dll]------RtlFreeUnicodeString || ||---[dll]------RtlAnsiStringToUnicodeString_ptr || ||---[dll]------RtlAnsiStringToUnicodeString_uptr || ||---[dll]------wcslen || ||---[dll]------strlen || ||---[dll]------IoDeleteDevice || ||---[dll]------IoCreateDevice || ||---[dll]------KeSetEvent_Ptr || ||---[dll]------KeWaitForSingleObject || ||---[dll]------ObfDereferenceObject || ||---[dll]------KeInitializeSpinLock_ptr || ||---[dll]------KeInitializeEvent || ||---[dll]------PsCreateSystemThread || ||---[dll]------IofCompleteRequest || ||---[dll]------ExfInterlockedInsertTailList || ||---[dll]------ExfInterlockedRemoveHeadList || ||---[dll]------KeGetCurrentThread || ||---[dll]------ObReferenceObjectByHandle || ||---[dll]------PsTerminateSystemThread || ||---[dll]------KeSetPriorityThread || ||---[dll]------MmMapLockedPagesSpecifyCache || ||---[dll]------ZwReadFile || ||---[dll]------ZwWriteFile || ||---[dll]------ZwCreateFile || ||---[dll]------ZwCreateFile2 || ||---[dll]------ZwSetInformationFile || ||---[dll]------ZwQueryInformationFile_Basic || ||---[dll]------ZwQueryInformationFile_Stand || ||---[dll]------ZwQueryInformationFile_Align || ||---[dll]------IoCreateSynchronizationEvent || ||---[dll]------KeResetEvent 调用的DLL命令: .DLL命令CopyTo_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数dest,DRIVER_OBJECT .参数src .参数length .DLL命令CopyTo_OPEN_FILE_INFORMATION,,"ntoskrnl.lib","@_memcpy" .参数dest,OPEN_FILE_INFORMATION .参数src .参数length .DLL命令CopyFrom_OPEN_FILE_INFORMATION,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,OPEN_FILE_INFORMATION .参数length .DLL命令CopyFrom_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,DRIVER_OBJECT .参数length .DLL命令CopyTo_UNICODE_STRING,,"ntoskrnl.lib","@_memcpy" .参数dest,UNICODE_STRING .参数src .参数length .DLL命令CopyFrom_UNICODE_STRING,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,UNICODE_STRING .参数length .DLL命令CopyFrom_DEVICE_EXTENSION,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,DEVICE_EXTENSION .参数length .DLL命令CopyFrom_DISK_GEOMETRY,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,DISK_GEOMETRY .参数length .DLL命令CopyFrom_GET_LENGTH_INFORMATION,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,GET_LENGTH_INFORMATION .参数length .DLL命令CopyFrom_PARTITION_INFORMATION,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,PARTITION_INFORMATION .参数length .DLL命令CopyFrom_PARTITION_INFORMATION_EX,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,PARTITION_INFORMATION_EX .参数length .DLL命令CopyFrom_CDROM_TOC,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,CDROM_TOC .参数length .DLL命令CopyTo_VERIFY_INFORMATION,,"ntoskrnl.lib","@_memcpy" .参数dest,VERIFY_INFORMATION .参数src .参数length .DLL命令CopyTo_SECURITY_CLIENT_CONTEXT,,"ntoskrnl.lib","@_memcpy" .参数dest,SECURITY_CLIENT_CONTEXT .参数src .参数length .DLL命令CopyTo_DEVICE_EXTENSION,,"ntoskrnl.lib","@_memcpy" .参数dest,DEVICE_EXTENSION .参数src .参数length .DLL命令CopyTo_IRP,,"ntoskrnl.lib","@_memcpy" .参数dest,IRP .参数src .参数length .DLL命令CopyTo_IO_STACK_LOCATION,,"ntoskrnl.lib","@_memcpy" .参数dest,IO_STACK_LOCATION .参数src .参数length .DLL命令CopyFrom_IRP,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,IRP .参数length .DLL命令CopyTo_IO_STATUS_BLOCK,,"ntoskrnl.lib","@_memcpy" .参数dest,IO_STATUS_BLOCK .参数src .参数length .DLL命令CopyTo_MDL,,"ntoskrnl.lib","@_memcpy" .参数dest,MDL .参数src .参数length .DLL命令CopyTo_DEVICE_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数dest,DEVICE_OBJECT .参数src .参数length .DLL命令CopyFrom_DEVICE_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src,DEVICE_OBJECT .参数length .DLL命令ExFreePool,,"ntoskrnl.lib","_ExFreePool@4" .参数p .DLL命令ExAllocatePoolWithTag,整数型,"ntoskrnl.lib","_ExAllocatePoolWithTag@12" .参数PoolType .参数NumberOfBytes .参数Tag .DLL命令PsRevertToSelf,,"ntoskrnl.lib","_PsRevertToSelf@0" .DLL命令SeCreateClientSecurity,整数型,"ntoskrnl.lib","_SeCreateClientSecurity@16" .参数Thread .参数QualityOfService,SECURITY_QUALITY_OF_SERVICE .参数RemoteClient,逻辑型 .参数ClientContext .DLL命令SeImpersonateClient,,"ntoskrnl.lib","_SeImpersonateClient@8" .参数ClientContext .参数ServerThread .DLL命令SeTokenType,整数型,"ntoskrnl.lib","_SeTokenType@4" .参数Token .DLL命令sizeof_xx,整数型,,"GlobalSize" .参数o,DEVICE_EXTENSION .DLL命令RtlCopyUnicodeString,,"ntoskrnl.lib","_RtlCopyUnicodeString@8" .参数DestinationString,UNICODE_STRING .参数SourceString,UNICODE_STRING .DLL命令RtlAppendUnicodeToString,整数型,"ntoskrnl.lib","_RtlAppendUnicodeToString@8" .参数Destination,UNICODE_STRING .参数Source,整数型 .DLL命令RtlAppendUnicodeStringToString,,"ntoskrnl.lib","_RtlAppendUnicodeStringToString@8" .参数Destination,UNICODE_STRING .参数Source,UNICODE_STRING .DLL命令RtlQueryRegistryValues,整数型,"ntoskrnl.lib","_RtlQueryRegistryValues@20" .参数RelativeTo .参数Path .参数QueryTable,RTL_QUERY_REGISTRY_TABLE,数组 .参数Context .参数Environment .DLL命令DbgPrint,整数型,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .DLL命令DbgPrint_1,整数型,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .参数arg1 .DLL命令DbgPrint_2s,整数型,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .参数arg1 .参数arg2,文本型 .DLL命令DbgPrint_2,整数型,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .参数arg1 .参数arg2 .DLL命令DbgPrint_3,整数型,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .参数arg1 .参数arg2 .参数arg3 .DLL命令DbgPrint_4,,"ntoskrnl.lib","@_DbgPrint" .参数pch,文本型 .参数arg1 .参数arg2 .参数arg3 .参数arg4 .DLL命令ZwCreateDirectoryObject,整数型,"ntoskrnl.lib","_ZwCreateDirectoryObject@12" .参数DirectoryHandle,,传址 .参数DesiredAccess .参数ObjectAttributes,OBJECT_ATTRIBUTES .DLL命令ZwMakeTemporaryObject,整数型,"ntoskrnl.lib","_ZwMakeTemporaryObject@4" .参数Handle .DLL命令ZwClose,整数型,"ntoskrnl.lib","_ZwClose@4" .参数Handle .DLL命令memcmp,整数型,"ntoskrnl.lib","@_memcmp" .参数cmp1 .参数cmp2 .参数length .DLL命令memmove,,"ntoskrnl.lib","@_memmove" .参数dest .参数src .参数length .DLL命令memcpy,,"ntoskrnl.lib","@_memcpy" .参数dest .参数src .参数length .DLL命令memset,,"ntoskrnl.lib","@_memset" .参数dest .参数value .参数length .DLL命令swprintf,,"ntoskrnl.lib","@_swprintf" .参数buffer,字节型,数组 .参数format .参数arg1 .DLL命令RtlInitAnsiString,,"ntdll.lib","_RtlInitAnsiString@8" .参数DestinationString,ANSI_STRING .参数SourceString,文本型 .DLL命令RtlInitAnsiString_Ptr,,"ntdll.lib","_RtlInitAnsiString@8" .参数DestinationString,ANSI_STRING .参数SourceString .DLL命令RtlInitUnicodeString,,"ntdll.lib","_RtlInitUnicodeString@8" .参数DestinationString,UNICODE_STRING .参数SourceString,字节型,数组 .DLL命令RtlFreeUnicodeString_ptr,,"ntdll.lib","_RtlFreeUnicodeString@4" .参数UnicodeString .DLL命令RtlFreeUnicodeString,,"ntdll.lib","_RtlFreeUnicodeString@4" .参数UnicodeString,UNICODE_STRING .DLL命令RtlAnsiStringToUnicodeString_ptr,,"ntdll.lib","_RtlAnsiStringToUnicodeString@12" .参数DestinationString,整数型 .参数SourceString,ANSI_STRING .参数AllocateDestinationString,逻辑型 .DLL命令RtlAnsiStringToUnicodeString_uptr,,"ntdll.lib","_RtlAnsiStringToUnicodeString@12" .参数DestinationString,整数型 .参数SourceString,ANSI_STRING .参数AllocateDestinationString,逻辑型 .DLL命令wcslen,整数型,"ntoskrnl.lib","@_wcslen" .参数s .DLL命令strlen,整数型,"ntoskrnl.lib","@_strlen" .参数s,文本型 .DLL命令IoDeleteDevice,,"ntoskrnl.lib","_IoDeleteDevice@4" .参数DeviceObject .DLL命令IoCreateDevice,整数型,"ntoskrnl.lib","_IoCreateDevice@28" .参数DriverObject .参数DeviceExtensionSize .参数DeviceName,UNICODE_STRING .参数DeviceType .参数DeviceCharacteristics .参数Exclusive,逻辑型 .参数DeviceObject,,传址 .DLL命令KeSetEvent_Ptr,整数型,"ntoskrnl.lib","_KeSetEvent@12" .参数Event,,,[必须是静态的KEVENT,不允许copy] .参数Increment .参数Wait,逻辑型 .DLL命令KeWaitForSingleObject,,"ntoskrnl.lib","_KeWaitForSingleObject@20" .参数Object .参数WaitReason .参数WaitMode .参数Alertable,逻辑型 .参数Timeout .DLL命令ObfDereferenceObject,,"ntoskrnl.lib","@@ObfDereferenceObject@4",,[fastcall][神奇的函数符号@@] .参数Object .DLL命令KeInitializeSpinLock_ptr,,"ntoskrnl.lib","_KeInitializeSpinLock@4" .参数SpinLock .DLL命令KeInitializeEvent,,"ntoskrnl.lib","_KeInitializeEvent@12" .参数Event,,,[必须是静态的KEVENT,不允许copy] .参数Type .参数State,逻辑型 .DLL命令PsCreateSystemThread,整数型,"ntoskrnl.lib","_PsCreateSystemThread@28" .参数ThreadHandle,,传址 .参数DesiredAccess .参数ObjectAttributes .参数ProcessHandle .参数ClientId .参数StartRoutine .参数StartContext .DLL命令IofCompleteRequest,,"ntoskrnl.lib","@@IofCompleteRequest@8",,[fastcall][神奇的函数符号@@] .参数Irp .参数PriorityBoost .DLL命令ExfInterlockedInsertTailList,整数型,"ntoskrnl.lib","@@ExfInterlockedInsertTailList@12",,[fastcall][神奇的函数符号@@] .参数ListHead .参数ListEntry .参数Lock .DLL命令ExfInterlockedRemoveHeadList,整数型,"ntoskrnl.lib","@@ExfInterlockedRemoveHeadList@8" .参数ListHead .参数Lock .DLL命令KeGetCurrentThread,整数型,"ntoskrnl.lib","_KeGetCurrentThread@0" .DLL命令ObReferenceObjectByHandle,整数型,"ntoskrnl.lib","_ObReferenceObjectByHandle@24" .参数Handle .参数DesiredAccess .参数ObjectType .参数AccessMode .参数Object,,传址 .参数HandleInformation .DLL命令PsTerminateSystemThread,整数型,"ntoskrnl.lib","_PsTerminateSystemThread@4" .参数ExitStatus .DLL命令KeSetPriorityThread,,"ntoskrnl.lib","_KeSetPriorityThread@8" .参数Thread .参数Priority .DLL命令MmMapLockedPagesSpecifyCache,整数型,"ntoskrnl.lib","_MmMapLockedPagesSpecifyCache@24" .参数MemoryDescriptorList .参数AccessMode .参数CacheType .参数BaseAddress .参数BugCheckOnFailure,逻辑型 .参数Priority .DLL命令ZwReadFile,整数型,"ntoskrnl.lib","_ZwReadFile@36" .参数FileHandle .参数Event .参数ApcRoutine .参数ApcContext .参数IoStatusBlock .参数Buffer .参数Length .参数ByteOffset,LARGE_INTEGER .参数Key .DLL命令ZwWriteFile,整数型,"ntoskrnl.lib","_ZwWriteFile@36" .参数FileHandle .参数Event .参数ApcRoutine .参数ApcContext .参数IoStatusBlock .参数Buffer .参数Length .参数ByteOffset,LARGE_INTEGER .参数Key .DLL命令ZwCreateFile,整数型,"ntoskrnl.lib","_ZwCreateFile@44" .参数FileHandle,,传址 .参数DesiredAccess .参数ObjectAttributes,OBJECT_ATTRIBUTES .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数AllocationSize .参数FileAttributes .参数ShareAccess .参数CreateDisposition .参数CreateOptions .参数EaBuffer .参数EaLength .DLL命令ZwCreateFile2,整数型,"ntoskrnl.lib","_ZwCreateFile@44" .参数FileHandle,,传址 .参数DesiredAccess .参数ObjectAttributes,OBJECT_ATTRIBUTES .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数AllocationSize,LARGE_INTEGER .参数FileAttributes .参数ShareAccess .参数CreateDisposition .参数CreateOptions .参数EaBuffer .参数EaLength .DLL命令ZwSetInformationFile,整数型,"ntoskrnl.lib","_ZwSetInformationFile@20" .参数FileHandle .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数FileInformation,FILE_END_OF_FILE_INFORMATION .参数Length .参数FileInformationClass .DLL命令ZwQueryInformationFile_Basic,整数型,"ntoskrnl.lib","_ZwQueryInformationFile@20" .参数FileHandle .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数FileInformation,FILE_BASIC_INFORMATION .参数Length .参数FileInformationClass .DLL命令ZwQueryInformationFile_Stand,整数型,"ntoskrnl.lib","_ZwQueryInformationFile@20" .参数FileHandle .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数FileInformation,FILE_STANDARD_INFORMATION .参数Length .参数FileInformationClass .DLL命令ZwQueryInformationFile_Align,整数型,"ntoskrnl.lib","_ZwQueryInformationFile@20" .参数FileHandle .参数IoStatusBlock,IO_STATUS_BLOCK,传址 .参数FileInformation,FILE_ALIGNMENT_INFORMATION .参数Length .参数FileInformationClass .DLL命令IoCreateSynchronizationEvent,整数型,"ntoskrnl.lib","_IoCreateSynchronizationEvent@8" .参数EventName .参数EventHandle,,传址 .DLL命令KeResetEvent,,"ntoskrnl.lib","_KeResetEvent@4" .参数Event