从Windows内核驱动程序持久写入文件

Question

您好我是内核级编程的新手，并尝试构建一个简单的日志写入驱动程序。我想要实现的是让持久性驱动程序将每个预定义的间隔写入引用文本到系统路径中的文件。 （我不熟悉IRQ挂钩）

我有以下全局定时

// Timer 
PKTIMER pTimer = NULL; // Pointer to the timer
PKDPC pDpcObject = NULL; // Pointer to the DPC
#define IDLE_INTERVAL (10000)

我在DriverEntry中调用以下代码（但是，以下代码的问题是它的写入功能在计算机重新启动时失败）有人会建议修复吗？是否应该通过IRQ主要电话呼叫？

while(1)
    {

        if (pTimer == NULL) // if timer object does not exist:
        {
            // Allocate memory for the object timer
            pTimer = (PKTIMER) ExAllocatePool (NonPagedPool, sizeof (KTIMER));
            KeInitializeTimer (pTimer); // Initialize the timer object
            // Allocate memory for the DPC object and initialize it
            pDpcObject = (PKDPC) ExAllocatePool (NonPagedPool, sizeof (KDPC));
            KeInitializeDpc (pDpcObject, MyDeferredRoutine, pTimer);
        }

        LARGE_INTEGER dueTime;
        dueTime.QuadPart = -10000 * IDLE_INTERVAL; // 10000 * 10000 * 1 ns
        // "Platoon" timer:
        KeSetTimerEx (pTimer,
                dueTime, // latency relative interval
                (IDLE_INTERVAL / 2), // period of 5 seconds, i.e. 5000 * 1 ms
                pDpcObject);

            if (KeReadStateTimer (pTimer))
            {
                //DbgPrint ("- Example- KeReadStateTimer returns TRUE.");
            }
            else
            {
            //  DbgPrint ("- Example- KeReadStateTimer returns FALSE.");
            }
        }
        Status = KeWaitForSingleObject (pTimer,
                       Executive, // IN KWAIT_REASON WaitReason,
                       KernelMode, // IN KPROCESSOR_MODE WaitMode,
                       FALSE, // IN BOOLEAN Alertable,
                       NULL); // IN PLARGE_INTEGER Timeout OPTIONAL



    RtlInitUnicodeString(&TestName, L"\\??\\C:\\log.txt");

    InitializeObjectAttributes(&ObjAttr, &TestName,
                                OBJ_CASE_INSENSITIVE,
                                0, NULL);

    Status = NtCreateFile(&TestFile,
                         FILE_WRITE_DATA + SYNCHRONIZE,
                         &ObjAttr,
                         &IoStatus, NULL,
                         FILE_ATTRIBUTE_NORMAL,
                         FILE_SHARE_WRITE,
                         FILE_OVERWRITE_IF,
                         FILE_SYNCHRONOUS_IO_NONALERT,
                         NULL, 0);
  if(Status == STATUS_SUCCESS)
  {
      Status = NtWriteFile(TestFile,
                            0, NULL, NULL,
                            &IoStatus,
                            (PCHAR)"OUR LOG STORED TO LOG FILE",
                            22,
                            NULL, NULL);
  }
  NtClose(TestFile);
    }