阅读:2350回复:1
Minifilter 文件隐藏问题
我最近在Minifilter下做文件隐藏的程序,代码大部分时候都能正常工作。不过在只有一个文件的时候,却无法隐藏。
代码如下: FLT_POSTOP_CALLBACK_STATUS IrpPostDirectoryControl( __inout PFLT_CALLBACK_DATA Data, __in PCFLT_RELATED_OBJECTS FltObjects, __in PVOID CompletionContext, __in FLT_POST_OPERATION_FLAGS Flags ) { FLT_PREOP_CALLBACK_STATUS returnStatus = FLT_POSTOP_FINISHED_PROCESSING; PFILE_BOTH_DIR_INFORMATION DirInfo = NULL; PFILE_BOTH_DIR_INFORMATION PreDirInfo = NULL; ULONG Length = 0; ULONG NewLength = 0; ULONG Offset = 0; ULONG CurPos = 0; UNREFERENCED_PARAMETER(Data); UNREFERENCED_PARAMETER(FltObjects); UNREFERENCED_PARAMETER(CompletionContext); UNREFERENCED_PARAMETER(Flags); if (FlagOn(Data->Flags,FLTFL_CALLBACK_DATA_IRP_OPERATION)) { while (TRUE) { Length = Data->Iopb->Parameters.DirectoryControl.QueryDirectory.Length; NewLength = Length; CurPos = 0; DirInfo = (PFILE_BOTH_DIR_INFORMATION) Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer; PreDirInfo = DirInfo; // // There is no entry, so just complete the request // if (Length == 0) break; // // Sanity check // if ((!DirInfo) || (DirInfo->NextEntryOffset > Length)) break; do { Offset = DirInfo->NextEntryOffset; if ((DirInfo->FileNameLength == SF_ENCRYPT_POSTFIX_LENGTH * sizeof(WCHAR)) && (_wcsnicmp(&DirInfo->FileName[0], SF_ENCRYPT_POSTFIX, SF_ENCRYPT_POSTFIX_LENGTH) == 0)) { if (0 == Offset) // if find and it is the last one { PreDirInfo->NextEntryOffset = 0; NewLength = CurPos; memset(DirInfo, 0, Data->Iopb->Parameters.DirectoryControl.QueryDirectory.Length); Data->IoStatus.Information = 0; return returnStatus; // Data->IoStatus.Status = STATUS_NO_SUCH_FILE; } else //if find and in the middle { if (PreDirInfo != DirInfo) { PreDirInfo->NextEntryOffset += DirInfo->NextEntryOffset; DirInfo = (PFILE_BOTH_DIR_INFORMATION) ((PUCHAR) DirInfo + Offset); } else //if find and it is the first one { RtlMoveMemory((PUCHAR) DirInfo,(PUCHAR) DirInfo + Offset, Length - CurPos - Offset); NewLength -= Offset; } } } else //get all of the entries { CurPos += Offset; PreDirInfo = DirInfo; DirInfo = (PFILE_BOTH_DIR_INFORMATION) ((PUCHAR) DirInfo + Offset); } } while (0 != Offset); Data->IoStatus.Information = NewLength; break; } } return returnStatus; } 是不是我没有处理SL_RETURN_SINGLE_ENTRY,碰到这种情况应该怎么处理? 哪位仁兄做过请提示下~ |
|
沙发#
发布于:2009-05-18 13:42
![]() 在线等~ |
|