I tried my own version of your code and it works on my machine (Server
2k3, NTFS drive). I tried with a pre-existing file of 0 length and then
again with 0x200 length. My code writes 0x200 bytes at offset 0x200. I
suggest you try to run my function on your computer and go from there:
#define DA_PATH L"\??\C:\foobar.txt"
NTSTATUS
TestFile()
{
PBYTE buf = NULL;
HANDLE hFile = NULL;
IO_STATUS_BLOCK ioStatus;
LARGE_INTEGER liOffset;
NTSTATUS status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES objAttribs;
UNICODE_STRING uPath;
buf = (PBYTE) ExAllocatePool(NonPagedPool, 0x200);
if (NULL == buf)
{
status = STATUS_INSUFFICIENT_RESOURCES;
goto try_exit;
}
memset(buf, 0x42, 0x200);
RtlInitUnicodeString(&uPath, DA_PATH);
InitializeObjectAttributes(&objAttribs, &uPath, OBJ_KERNEL_HANDLE,
NULL,
NULL);
status = ZwCreateFile(&hFile, GENERIC_READ | GENERIC_WRITE,
&objAttribs, &ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS |
FILE_NO_INTERMEDIATE_BUFFERING | FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0);
if (!NT_SUCCESS(status))
goto try_exit;
liOffset.QuadPart = 0x200;
status = ZwWriteFile(hFile, NULL, NULL, NULL, &ioStatus, buf, 0x200,
&liOffset, NULL);
if (!NT_SUCCESS(status))
goto try_exit;
try_exit:
if (NULL != buf)
ExFreePool(buf);
if (NULL != hFile)
ZwClose(hFile);
return status;
}
SXW wrote:
//file created as :
status = ZwCreateFile( &file_handle,
GENERIC_READ | GENERIC_WRITE,
&object_attributes,&IoStatus,NULL,FILE_ATTRIBUTE_NORMAL,0,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE |
FILE_RANDOM_ACCESS |
FILE_NO_INTERMEDIATE_BUFFERING |
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,0 );
//offset & size
if( uWriteSize & (SECTOR_SIZE-1)){
uWriteSize += SECTOR_SIZE;
uWriteSize &= (~(SECTOR_SIZE-1));
//buffer is big enough
}
writeOffset = device_extension->file_information.EndOfFile;
DbgMsg((“Append - write @ %I64u - %08x\n”, writeOffset.QuadPart,
uWriteSize));
//the size dumped is 0x200
//write to the end of file
status = ZwWriteFile( file_handle,NULL,NULL,NULL,&iostatus,
pBuffer,uWriteSize,&writeOffset,NULL);
if( !NT_SUCCESS( status ) ){
DbgMsg((“Append - write err %08x\n”, status));
return status ;
}
the write operation will get 0xc0000002(STATUS_NOT_IMPLEMENTED)
I’d tested these codes under usermode, write ok. 
Thanks,
“Nick Ryan” wrote into:xxxxx@ntfsd…
>
>>Can you show us the code?
>
>
>
>
>
>
–
Nick Ryan (MVP for DDK)