SAMPLE: Zwcf.exe Uses ZwCreateFile() to Open File from Kernel

PSS ID Number: Q126286

Article Last Modified on 03-12-2002

• Microsoft Win32 Device Driver Kit (DDK) for Windows NT 3.5, 3.51, 4.0

Summary

Zwcf.exe is a sample that demonstrates how to open a file from a Windows NT kernel-mode device driver using ZwCreateFile(). Once the file is open, it reads the contents of this file into a buffer using ZwReadFile(). After reading the file, it is closed using ZwClose().

NOTE: When you use the sample, the Info.dat file in the \SystemRoot\System32\Drivers directory must be available.

More Information

Microsoft Windows 2000 and Windows XP provides a new object attribute, OBJ_KERNEL_HANDLE, that can be used with ZwCreateFile(). This attribute specifies to the system that the handle returned by ZwCreateFile() should reference the system context rather then any particular user mode context that it may have been created in.

NOTE: This object is included in the Windows XP DDK. The following file is available for download from the Microsoft Download Center: