我想用WDM来写系统对文件操作的监控，不知道这样会不会使系统开销过大？

我要写一个系统程序，监控文件操作的系统API的调用，是纯软件的，没有硬件。担心用WDM会使操作系统开销过大，影响性能。还有就使WDM能否胜任这个工作呢？

1，用WDM正合适
2，细心编码，开销不会太大

对了， 我是新手，没有经验，请问什么工具资料比较全一点，好上手的。

文件监控已讨论多次了，都有SOURCE CODE，你在本站搜索一下!

我要写一个系统程序，监控文件操作的系统API的调用，是纯软件的，没有硬件。担心用WDM会使操作系统开销过大，影响性能。还有就使WDM能否胜任这个工作呢？

严格的说，文件系统的驱动程序及其过滤驱动程序并不属于WDM，在9x系统中，你只可以使用VXD实现这些功能，然而在NT和2000中，已经没有VXD的概念。NT中是KMD，2000中是WDM。KMD和WDM是如此的近接以至于多少人把它们混为一谈。IFS KIT Documentation中有一篇专门谈到，文件系统驱动程序及其过滤驱动程序不是WDM程序，而是KMD。
不过这点并不影响你的开发，因为这们的开发方式简直没有什么不同。不过，懂得这点区别对于实际开发是有帮助的。www.osr.com网站上的2000 XP IFS FAQ文档也如是说明了这一点。
KMD与WDM的本质区别在于KMD不支持电源管理，不支持PNP，所以毫无疑问，文件系统的任何驱动程序不用考虑这两个功能。（减轻了一大半：））
顺带说一句，9x的文件系统驱动程序只能用VXD， NT、2000只能用KMD

1，用WDM正合适
2，细心编码，开销不会太大

花猫，嘿嘿

Tom_lyd的意思是不是说，我要是想在98和2k下都实现这个功能，就必须把不同的操作系统分开来实现。能介绍一下KMD吗？

 以下文章摘自IFS KIT Documentation
Installable File System Kit
2.2.2 How File System Filter Drivers Are Different from Device Drivers
[This is preliminary documentation and subject to change.]

The following sections describe some of the differences between file system filter drivers and device drivers.

No Power Management
Because they are not device drivers and thus do not control hardware devices directly, file system filter drivers do not receive IRP_MJ_POWER requests. However, it is possible for file system filter drivers to interfere with power management. For this reason, file system filter drivers must obey the following rules:

Never register dispatch routines for IRP_MJ_POWER in DriverEntry.
Never call PoXxx routines.
No WDM
File system filter drivers cannot be WDM drivers. The Microsoft Windows? Driver Model is only for device drivers. For more information about file system driver development in Windows 95, Windows 98, and Windows Me, see the Windows Me Device Driver Kit (DDK).

No AddDevice or StartIo
Because they are not device drivers and thus do not control hardware devices directly, file system filter drivers do not have AddDevice or StartIo routines.

Different Device Objects Created
Although file system filter drivers and device drivers both create device objects, they differ in the number and kinds of device objects they create.

Device drivers create physical and functional device objects to represent devices. The PnP Manager builds and maintains a global device tree that contains all device objects created by device drivers. The device objects created by file system filter drivers are not contained in this device tree.

File system filter drivers do not create functional or physical device objects. Instead, they create control device objects and filter device objects. The control device object (CDO) represents the filter driver to the system and to user-mode applications. The filter device object (filter DO) performs the actual work of filtering a specific file system or volume. A file system filter driver normally creates one CDO and one or more filter DOs.

Other Differences
Unlike device drivers, file system filter drivers do not perform DMA or METHOD_DIRECT I/O.

Unlike device filter drivers, which can attach above or below a target device\'s function driver, file system filter drivers can only attach above a target file system driver. Thus, in device-driver terms, a file system filter driver can only be an upper filter, never a lower filter.

Built on Thursday, August 17, 2000

胜读十天书啊，不过还是没什么头绪，毕竟没做过啊。放分

再问一句，文章再哪里找到的，我在98DDK里怎么找不到呢？

呵呵，我上面有写啊！

微软不让下，怎么办？呜呜呜呜呜呜……

微软不让下，怎么办？呜呜呜呜呜呜……

本站好象有下

没找到啊，好象没有，能给出地址吗？谢谢

在高级会员区ifs 2600即是。

我一介草民，何德何能为高级会员，就没有别的办法吗？

关注~~~~~~~~~~~~~~~~
好代码让大家看看算了!!!!! :D