|
阅读：1010回复：6
请教各位仁兄,除了用文件名外,还有啥办法精确判断一个文件是流?
我们知道流以:号开始文件名,但是有没有啥标志可以精确判断文件是流?
试过fileobj的flags fo_stream_file 好象不行.... |
|
|
|
沙发#
发布于：2007-10-19 11:49
thx.
|
|
|
|
板凳#
发布于：2007-10-18 22:59
All files in NTFS are streams. The file without ':' is the default data stream. It just has no additional stream name. So check this ':' character is a simple way.
Another way I can think of is that try to use file ID. First query the file ID. All streams of the same file should return the same ID. Then open file by this ID and compare file contexts. Since only primary data stream can be opened by ID, file contexts comparison should tell the truth. But this way seems not as simple as file name filtering. |
|
|
地板#
发布于：2007-10-17 20:47
此事不关卡吧事.hehe
|
|
|
|
地下室#
发布于：2007-10-17 18:56
是不是卡巴斯基带来了问题?
|
|
|
|
5楼#
发布于：2007-10-17 17:17
我只知道 fo_stream_file 是用来设置Metafile的，Metafile会至这一位的（postcreate完成之后）。这个标志位应该不是用来判断普通文件流的。
|
|
|
6楼#
发布于：2007-10-17 16:03
听课，等高手登台授业。
|
|
