#include<ntddk.h>

VOID UnLoad(PDRIVER_OBJECT driver)
{

}

NTSTATUS DriverEntry(PDRIVER_OBJECT driver,PUNICODE_STRING Reg_Path)
{
    NTSTATUS status;
         UNICODE_STRING str_clew;

    OBJECT_ATTRIBUTES attr;
    UNICODE_STRING uStr;
    HANDLE hHnd;
    IO_STATUS_BLOCK ioBlok;
    UNICODE_STRING path=RTL_CONSTANT_STRING(L"\\??\\C:\\log.log");
         RtlInitUnicodeString(&str_clew,L"Now Let us Check ");
    RtlInitUnicodeString(&uStr,L"How are you now ");
    KdPrint(("%wZ",&str_clew));




#if DBG
    _asm int 3
#endif
    
    InitializeObjectAttributes(&attr,&path,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,NULL,NULL);
    status=ZwCreateFile(&hHnd,GENERIC_ALL,&attr,&ioBlok,NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
        FILE_OPEN_IF,
        FILE_NON_DIRECTORY_FILE|FILE_RANDOM_ACCESS|FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);
    if (status==STATUS_SUCCESS)            //调试的时候走到这 就停了
    {
        IO_STATUS_BLOCK io;
        FILE_STANDARD_INFORMATION ftp;
        FILE_POSITION_INFORMATION fsp;
        ZwQueryInformationFile(hHnd, &io, &ftp, sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation);
        fsp.CurrentByteOffset = ftp.EndOfFile;    
        ZwSetInformationFile(hHnd, &io, &fsp, sizeof(FILE_POSITION_INFORMATION), FilePositionInformation);
        
        status=ZwWriteFile(
            hHnd,
            NULL,
            NULL,
            NULL,
            &ioBlok,
            uStr.Buffer,
            uStr.Length,
            NULL,
            NULL);
    }
   
   ZwClose(hHnd);


    driver->DriverUnload=UnLoad;
    return STATUS_SUCCESS;
}