windows native app demo

WDK 7.1

//makefile
!INCLUDE $(NTMAKEENV)\makefile.def

//sources
TARGETNAME=demo
TARGETPATH=obj
TARGETTYPE=PROGRAM
UMTYPE=nt
USE_NTDLL=1

MINWIN_SDK_LIB_PATH=$(SDK_LIB_PATH)
INCLUDES=$(DDK_INC_PATH)

SOURCES=native.c

//native.c
#include "ntddk.h"
#include "stdio.h"
#include "native.h"

HANDLE Heap;


void NtProcessStartup( PSTARTUP_ARGUMENT Argument )
{
    PUNICODE_STRING     commandLine;
    PWCHAR              stringBuffer, argPtr;
    UNICODE_STRING      helloWord;
    RTL_HEAP_DEFINITION heapParams;

    //init
    //
    memset(&heapParams, 0, sizeof(RTL_HEAP_DEFINITION));
    heapParams.Length = sizeof(RTL_HEAP_DEFINITION);
    Heap = RtlCreateHeap(2, 0, 0x100000, 0x1000, 0, &heapParams);

    commandLine = &Argument->Environment->CommandLine;

    argPtr = commandLine->Buffer;
    while (*argPtr != L' ') argPtr++;
    argPtr++;

    stringBuffer = RtlAllocateHeap(Heap, 0, 256);
    swprintf(stringBuffer, L"\n%s", argPtr);
    helloWord.Buffer = stringBuffer;
    helloWord.Length = wcslen(stringBuffer) * sizeof(WCHAR);
    helloWord.MaximumLength = helloWord.Length + sizeof(WCHAR);
    NtDisplayString(&helloWord);

    //free
    RtlFreeHeap(Heap, 0, stringBuffer);

    NtTerminateProcess(NtCurrentProcess(), 0);
}

//native.h
typedef struct {
    ULONG           Unknown[21];
    UNICODE_STRING  CommandLine;
    UNICODE_STRING  ImageFile;
}ENVIRONMENT_INFORMATION, *PENVIRONMENT_INFORMATION;

typedef struct {
    ULONG                       Unknown[3];
    PENVIRONMENT_INFORMATION    Environment;
}STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT;

typedef struct {
    ULONG Length;
    ULONG   Unknown[11];
}RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;

NTSTATUS
NTAPI
NtDisplayString(
        PUNICODE_STRING String
        );

NTSTATUS
NTAPI
NtTerminateProcess(
        HANDLE ProcessHandle,
        LONG ExitStatus
        );


HANDLE
NTAPI
RtlCreateHeap(
        ULONG Flags,
        PVOID BaseAddress,
        ULONG SizeToReserve,
        ULONG SizeToCommit,
        PVOID Unknown,
        PRTL_HEAP_DEFINITION Definition
        );

PVOID
NTAPI
RtlAllocateHeap(
        HANDLE Heap,
        ULONG Flags,
        ULONG Size
        );


BOOLEAN
NTAPI
RtlFreeHeap(
        HANDLE Heap,
        ULONG Flags,
        PVOID Address
        )

参考：
http://www.cnblogs.com/BoyXiao/archive/2011/09/21/2183059.html