阅读:896回复:1
请教 wengzuhong 关于隐藏文件长度
IRP_MJ_QUERY_INFORMATION 中
switch (currentIrpStack->Parameters.QueryFile.FileInformationClass) { // case FilePositionInformation: case FileStandardInformation: case FileAlignmentInformation: case FileEndOfFileInformation: case FileAllInformation: //传到下层驱动处理 status = SfForwardIrpSyncronously(hookExt->FileSystem, Irp); break; default: { if( fullPathName && fullPathName != InsufficientResources ) { ExFreeToNPagedLookasideList( &FullPathLookaside, fullPathName ); } IoSkipCurrentIrpStackLocation(Irp); return IoCallDriver(hookExt->FileSystem, Irp); } }// end of switch if ( !NT_SUCCESS ( status )){ if( fullPathName && fullPathName != InsufficientResources ) { ExFreeToNPagedLookasideList( &FullPathLookaside, fullPathName ); } Irp->IoStatus.Status = status; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status; } DbgPrint("informationclass %d\n", currentIrpStack->Parameters.QueryFile.FileInformationClass ); switch ( currentIrpStack->Parameters.QueryFile.FileInformationClass ) { // case FilePositionInformation: // ((PFILE_POSITION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)-> // CurrentByteOffset.QuadPart -= 4; // break; case FileEndOfFileInformation: ((PFILE_END_OF_FILE_INFORMATION)Irp->AssociatedIrp.SystemBuffer)-> EndOfFile.QuadPart -= 4; break; case FileStandardInformation: ((PFILE_STANDARD_INFORMATION)Irp->AssociatedIrp.SystemBuffer)-> EndOfFile.QuadPart -= 4; break; case FileAllocationInformation: ((PFILE_ALLOCATION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)-> AllocationSize.QuadPart -= 4; break; case FileAllInformation: ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->PositionInformation.CurrentByteOffset.QuadPart -= 4; ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->StandardInformation.EndOfFile.QuadPart -= 4; break; default: break; } Irp->IoStatus.Status = status; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status; 1,写字板可以打开,但长度还是老长度,尾部不能去掉4个字节 2.notepad无法打开,报空间不足的对话框? 3.IRP_DIRECTORY_CONTROL 好像重来没进入过. 这个隐藏文件长度到底要做什么呢? help me |
|
|
沙发#
发布于:2007-11-15 08:54
自己顶一下。做过的帮整个思路。
|
|
|