BsdItemTable LocalSystemAuthority NDEBUG RtlCreateBootStatusDataFile RtlCreateSystemVolumeInformationFolder RtlGetSetBootStatusData RtlLockBootStatusData RtlpSysVolCheckOwnerAndSecurity RtlpSysVolCreateSecurityDescriptor RtlpSysVolTakeOwnership RtlUnlockBootStatusData

NTSTATUS NTAPI RtlCreateBootStatusDataFile ( VOID  ) Definition at line 686 of file bootdata.c. Referenced by RegistrationProc(). { OBJECT_ATTRIBUTES ObjectAttributes; IO_STATUS_BLOCK IoStatusBlock; LARGE_INTEGER AllocationSize; LARGE_INTEGER ByteOffset; UNICODE_STRING FileName; HANDLE FileHandle; NTSTATUS Status; /* Initialize the file name */ RtlInitUnicodeString(&FileName, L"\\SystemRoot\\bootstat.dat"); /* Initialize the object attributes */ InitializeObjectAttributes(&ObjectAttributes, &FileName, OBJ_CASE_INSENSITIVE, NULL, NULL); AllocationSize.QuadPart = 0x800; /* Create the boot status data file */ Status = ZwCreateFile(&FileHandle, FILE_GENERIC_READ | FILE_GENERIC_WRITE, &ObjectAttributes, &IoStatusBlock, NULL, //&AllocationSize, FILE_ATTRIBUTE_SYSTEM, 0, FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0); if (NT_SUCCESS(Status)) { // FIXME: Initialize the buffer in a better way. UCHAR Buffer[12] = {0xC,0,0,0, 1,0,0,0, 1, 0x1e, 1, 0}; ByteOffset.QuadPart = 0; Status = ZwWriteFile(FileHandle, NULL, NULL, NULL, &IoStatusBlock, &Buffer, 12, //BufferSize, &ByteOffset, NULL); } /* Close the file */ ZwClose(FileHandle); return Status; }