minifilter中fltWriteFile 的用法

WriteBuff = FltAllocatePoolAlignedWithTag(Data->Iopb->TargetInstance, PagedPool, PAGE_SIZE, 'abcd');
    if (WriteBuff != NULL)
    {
        RtlFillMemory(WriteBuff, PAGE_SIZE, 0xFF);
        ByteOffset.QuadPart = 0;

        while (ByteOffset.QuadPart < FileSize.QuadPart)
        {
            Size.QuadPart = (FileSize.QuadPart - ByteOffset.QuadPart) > PAGE_SIZE ?
                                     PAGE_SIZE : (FileSize.QuadPart - ByteOffset.QuadPart);
            status = FltWriteFile(Data->Iopb->TargetInstance,
                                   FileObject,
                                   &ByteOffset,
                                   Size.LowPart,
                                   WriteBuff,
                                   FILE_NO_INTERMEDIATE_BUFFERING|FLTFL_IO_OPERATION_PAGING |
                                   FLTFL_IO_OPERATION_NON_CACHED,
                                   &WriteBytes, NULL, NULL);
            ByteOffset.QuadPart += WriteBytes;
            if (!(NT_SUCCESS(status)))
                break;
        }

        FltFreePoolAlignedWithTag(Data->Iopb->TargetInstance, WriteBuff, 'abcd');
    }

1. FltAllocatePoolAlignedWithTag是用于非缓冲I/O的；

2. FltWriteFile的第6个参数只能是下面所列参数的组合：
     FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET
     FLTFL_IO_OPERATION_NON_CACHED
     FLTFL_IO_OPERATION_PAGING

3. 既然你使用的是非缓冲I/O， 那么你就必须保证I/O的偏移量以及I/O的大小都要和卷的扇区大小对齐；