阅读:2102回复:1
关于串口监视程序!
我仿照网友提供的文件系统监视程序(filesrc.zip),编写了一个串口监视程序,但总是在钩子处理例程中的IoCallDriver()处死机。
源代码如下,那位高手帮我看一看有什么问题? (其它部分略) BOOLEAN HookSerial( IN PDRIVER_OBJECT DriverObject, FILE_SYSTEM_TYPE FsType ) { IO_STATUS_BLOCK ioStatus; HANDLE ntFileHandle; OBJECT_ATTRIBUTES objectAttributes; PDEVICE_OBJECT fileSysDevice; PDEVICE_OBJECT topAttachDevice; PDEVICE_OBJECT hookDevice; UNICODE_STRING fileNameUnicodeString; WCHAR Com1Filename[] = L"\\Device\\Serial0"; WCHAR Com2Filename[] = L"\\Device\\Serial1"; NTSTATUS ntStatus; ULONG i; PFILE_OBJECT fileObject; PHOOK_EXTENSION hookExtension; // // If we've already hooked it, just return success // if( FsType == COM1 && COM1HookDevice ) return TRUE; if( FsType == COM2 && COM2HookDevice ) return TRUE; // // We have to figure out what device to hook - first open the volume's // root directory // if( FsType == COM1 ) RtlInitUnicodeString( &fileNameUnicodeString, Com1Filename ); else RtlInitUnicodeString( &fileNameUnicodeString, Com2Filename ); InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL ); ntStatus = ZwCreateFile( &ntFileHandle, /*SYNCHRONIZE|FILE_ANY_ACCESS*/FILE_READ_DATA, &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ/*|FILE_SHARE_WRITE*/, FILE_OPEN, /*FILE_SYNCHRONOUS_IO_NONALERT|*/FILE_NON_DIRECTORY_FILE, NULL, 0 ); if( !NT_SUCCESS( ntStatus ) ) { DbgPrint(("Filemon: Could not open %s\n", FsType == COM1 ? "COM1" : "COM2", ntStatus )); return FALSE; } DbgPrint(("Filemon: opened the root directory!!! handle: %x\n", ntFileHandle)); // // Got the file handle, so now look-up the file-object it refers to // ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA, NULL, KernelMode, &fileObject, NULL ); if( !NT_SUCCESS( ntStatus )) { DbgPrint(("Filemon: Could not get fileobject from %s handle: %x\n", FsType == COM1 ? "COM1" : "COM2", ntStatus )); ZwClose( ntFileHandle ); return FALSE; } // // Next, find out what device is associated with the file object by getting its related // device object // fileSysDevice = IoGetRelatedDeviceObject( fileObject ); if( ! fileSysDevice ) { DbgPrint(("Filemon: Could not get related device object for %s: %x\n", FsType == COM1 ? "COM1" : "COM2", ntStatus )); ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } // // The file system's device hasn't been hooked already, so make a hooking device // object that will be attached to it. // ntStatus = IoCreateDevice( DriverObject, sizeof(HOOK_EXTENSION), NULL, fileSysDevice->DeviceType, 0, FALSE, &hookDevice ); if( !NT_SUCCESS(ntStatus) ) { DbgPrint(("Filemon: failed to create associated device %s: %x\n", FsType == COM1 ? "COM1" : "COM2", ntStatus )); ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } // // Clear the device's init flag as per NT DDK KB article on creating device // objects from a dispatch routine // hookDevice->Flags &= ~DO_DEVICE_INITIALIZING; // // Finally, attach to the device. The second we're successfully attached, we may // start receiving IRPs targetted at the device we've hooked. // topAttachDevice = IoAttachDeviceToDeviceStack( hookDevice, fileSysDevice ); if( !topAttachDevice ) { // // Couldn' attach for some reason // DbgPrint(("Filemon: Connect with Filesystem failed: %s (%x) =>%x\n", FsType == COM1 ? "COM1" : "COM2", fileSysDevice, ntStatus )); // // Derefence the object and get out // ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } else { DbgPrint(("Filemon: Successfully connected to Filesystem device %s\n", FsType == COM1 ? "COM1" : "COM2" )); } // // Setup the device extensions. The drive letter and file system object are stored // in the extension. // hookExtension = hookDevice->DeviceExtension; hookExtension->LogicalDrive = '\\'; hookExtension->FileSystem = topAttachDevice; hookExtension->Hooked = TRUE; hookExtension->Type = FsType; // // Close the file and update the hooked drive list by entering a // pointer to the hook device object in it. // ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); if( FsType == COM1 ) COM1HookDevice = hookDevice; else COM2HookDevice = hookDevice; return TRUE; } NTSTATUS FilemonHookRoutine( PDEVICE_OBJECT HookDevice, IN PIRP Irp ) { ..... ..... return IoCallDriver( hookExt->FileSystem, Irp ); } |
|
最新喜欢:![]()
|
沙发#
发布于:2001-09-13 14:12
你的问题正好也是我想问的!!,那位大虾要是能够解决,也要
通知我一声啊,这个问题很特别,希望各位高手不吝赐教 my mail :nicexu@yahoo.com.cn |
|