阅读:1486回复:1
【求助】关于文件过滤驱动的问题
最近写了个文件过滤驱动,老是出一些莫名其妙的错误,各位大牛帮忙看一下,先行谢过
DirectoryControlComplete proc DeviceObject,pIrp,Context pushad invoke KeSetEvent,Context,IO_NO_INCREMENT,0 popad mov eax,STATUS_MORE_PROCESSING_REQUIRED ret DirectoryControlComplete endp DispatchDirectoryControl proc DeviceObject,pIrp local waitEvent:KEVENT pushad mov edx,pIrp mov esi,[edx+60h] ;CurrentStackLocation .if byte ptr[esi+1]!=1 || byte ptr[edx+20h]==KernelMode || dword ptr[esi+0ch]!=3 jmp _end .endif invoke KeInitializeEvent,addr waitEvent,NotificationEvent,0 mov edx,pIrp ;IoCopyCurrentIrpStackLocationToNext mov esi,[edx+60h] mov ecx,7 lea edi,[esi-sizeof IO_STACK_LOCATION] ;[esi-24h] rep movsd mov edx,pIrp ;IoSetCompleteRoutine mov esi,[edx+60h] sub esi,24h mov [esi+1ch],offset DirectoryControlComplete lea eax,waitEvent mov [esi+20h],eax ;Context mov byte ptr[esi+3h],SL_INVOKE_ON_SUCCESS or SL_INVOKE_ON_ERROR or \ SL_INVOKE_ON_CANCEL mov edx,pIrp mov ecx,DeviceObject mov ecx,[ecx+28h] ;DeviceExtension mov ecx,(HOOK_EXTENSION ptr[ecx]).FileSystem call IofCallDriver .if eax == STATUS_PENDING invoke KeWaitForSingleObject,addr waitEvent,Executive,KernelMode,0,0 .endif mov edx,pIrp mov esi,[edx+60h] ; .if eax != STATUS_SUCCESS || dword ptr[esi+4] == 0 ; jmp _1 ; .endif ; invoke HandleDirectoryControl,dword ptr[edx+3ch],esi _1: popad invoke IoCompleteRequest,pIrp,IO_NO_INCREMENT ret _end: popad mov edx,pIrp inc byte ptr[edx+23h] ;CurrentLocation add dword ptr[edx+60h],24h ;CurrentStackLocation mov ecx,DeviceObject mov ecx,[ecx+28h] ;DeviceExtension mov ecx,(HOOK_EXTENSION ptr[ecx]).FileSystem call IofCallDriver ret DispatchDirectoryControl endp 为什么会蓝屏,各位大牛帮忙看看, ![]() ![]() |
|
|
沙发#
发布于:2008-04-01 08:25
这个是IRP_MJ_DIRECTORY_CONTROL派遣函数
|
|
|