阅读:1807回复:2
filemon中一段代码,百思不得其解,望大家帮忙
//----------------------------------------------------------------------
// // FilemonQueryFile // // This function retrieves the \"standard\" information for the // underlying file system, asking for the filename in particular. // //---------------------------------------------------------------------- BOOLEAN FilemonQueryFile( PDEVICE_OBJECT DeviceObject, PFILE_OBJECT FileObject, FILE_INFORMATION_CLASS FileInformationClass, PVOID FileQueryBuffer, ULONG FileQueryBufferLength ) { PIRP irp; KEVENT Queryevent; IO_STATUS_BLOCK IoStatusBlock; PIO_STACK_LOCATION ioStackLocation; DbgPrint((\"Getting file name for %x\\n\", FileObject)); // // Initialize the event // KeInitializeEvent(&Queryevent, SynchronizationEvent, FALSE); // // Allocate an irp for this request. This could also come from a // private pool, for instance. // irp = IoAllocateIrp(DeviceObject->StackSize, FALSE); if(!irp) { // // Failure! // return FALSE; } // // Build the IRP\'s main body // irp->AssociatedIrp.SystemBuffer = FileQueryBuffer; irp->UserEvent = &Queryevent; irp->UserIosb = &IoStatusBlock; irp->Tail.Overlay.Thread = PsGetCurrentThread(); irp->Tail.Overlay.OriginalFileObject = FileObject; irp->RequestorMode = KernelMode; irp->Flags = 0; // // Set up the I/O stack location. // ioStackLocation = IoGetNextIrpStackLocation(irp); //ioStackLocation->MajorFunction = IRP_MJ_QUERY_INFORMATION; ioStackLocation->MajorFunction = IRP_MJ_READ; ioStackLocation->DeviceObject = DeviceObject; ioStackLocation->FileObject = FileObject; ioStackLocation->Parameters.Read.Length = 64; ioStackLocation->Parameters.Read.ByteOffset.QuadPart = (LONGLONG) 0; //ioStackLocation->Parameters.QueryFile.Length = FileQueryBufferLength; //ioStackLocation->Parameters.QueryFile.FileInformationClass = FileInformationClass; // // Set the completion routine. // IoSetCompletionRoutine(irp, QueryFileComplete, 0, TRUE, TRUE, TRUE); // // Send it to the FSD // (void) IoCallDriver(DeviceObject, irp); // // Wait for the I/O // KeWaitForSingleObject(&Queryevent, Executive, KernelMode, TRUE, 0); // // Done! Note that since our completion routine frees the IRP we cannot // touch the IRP now. // return NT_SUCCESS( IoStatusBlock.Status ); } 此代码是我变形厚的代码,改为READ,注释掉的是原代码部分,放在FILEMONGETFULLPATH函数中FILEMONQUERYFILE后,IOCALLDRIVER后返回0XC000000D,查得好象是参数错误,但是我真不知参数哪里有错,请大家指教。如用其原代码不会出错,但是,如果把其原代码放在FILEMONGETFULLPATH函数外,我放在CREATE中,也得到0XC000000D错误,敬请指教。 希望大家能给出创建IRP的好的例子代码。THX |
|
|
沙发#
发布于:2001-12-06 20:10
换成IRP_MJ_READ后后的错误是明显的:对于不同类型的IRP,其参数设置是不同的,该段代码对应于API函数GetFileAttributes,如果想都数据的话好多参数得重新设置,如果没有参考资料并且又不是系统调试高手的话基本上是设不对的。想读数据的话用IoBuildAsynchronousFsdRequest构造IRP,这样参数设置会简单些,但也不容易。
|
|
|
板凳#
发布于:2001-12-07 13:40
谢谢sijun
|
|
|