阅读:3942回复:0
请教关于IRP_PAGING_IO IRP_SYNCHRONOUS_PAGING_IO IRP_NOCACHE标识符的处理
最近在完成一份文档加解密的驱动,框架已经搭好,终于来到了加解密的判断点这个节骨眼上,在网上搜寻了一些资料,其中论坛置顶区ai3000 的《Windows 文件过滤驱动经验总结》一文中提到只需处理带 IRP_PAGING_IO,IRP_SYNCHRONOUS_PAGING_IO,IRP_NOCACHE 标识符的IRP。不知具体的做法是如何的。按照自己的理解,我在SfRead和SfWrite中进行了如下判断,不知是否正确,希望有朋友能够进行一些指点。另外SfCreate是否也只需要处理带此类标志符的 IRP?
NTSTATUS SfRead( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { ... .... Status = IoCallDriver( ((PDEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedToDeviceObject, Irp ); if( Status == STATUS_PENDING ) { Status = KeWaitForSingleObject( &WaitEvent, Executive, KernelMode, FALSE, NULL ); } ... .... if( KeReadStateEvent( &WaitEvent ) ) { ... .... if( ( Irp->Flags & IRP_NOCACHE ) || ( Irp->Flags & IRP_PAGING_IO ) || ( Irp->Flags & IRP_SYNCHRONOUS_PAGING_IO )) ) { 解密操作... .... .... } } .... ..... } NTSTATUS SfWrite( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { ... .... if( ( Irp->Flags & IRP_NOCACHE ) || ( Irp->Flags & IRP_PAGING_IO ) || ( Irp->Flags & IRP_SYNCHRONOUS_PAGING_IO )) ) { 加密密操作... .... .... } Status = IoCallDriver( ((PDEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedToDeviceObject, Irp ); if( Status == STATUS_PENDING ) { Status = KeWaitForSingleObject( &WaitEvent, Executive, KernelMode, FALSE, NULL ); } ... .... if( KeReadStateEvent( &WaitEvent ) ) { ... .... } .... ..... } |
|