阅读:5390回复:6
无法解决FltWriteFile返回STATUS_NOT_IMPLEMENTED(0xC0000002)
给位看官:
本人根据 DDK 中 miniFilter 的 swapBuffers、passThrough 和 ctx 写了一个基于文件类型和应用程序名为规则的过滤程序,在测试文件尾的时候发生问题,请各位看官帮忙给个提示: 使用 FltWriteFile 在 PreCleanup 执行时写入文件尾,测试时指定了4个规则,分别是:"mspaint.exe"-> "bmp"; "mspaint.exe"-> "jpg";"notepad.exe"-> "txt";"wordpad.exe"->"rtf"; 写入 txt 和 rtf 的文件尾没有问题,但在写入 bmp 和 jpg 文件尾时,FltWriteFile 返回 STATUS_NOT_IMPLEMENTED (0xC0000002),此错误码的含义是:The requested operation is not implemented。 犯愁呀,各位看官大侠帮忙给个提示,看错在什么地方。 ![]() ![]() ![]() |
|
沙发#
发布于:2009-06-02 07:03
这是调用代码:
status = FltWriteFile( pFltObjects->Instance, pFltObjects->FileObject, &liOutFileSize, sizeof(FILE_MARK_INFO), &stuFileMark, FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET | FLTFL_IO_OPERATION_NON_CACHED, &ulBytesWritten, NULL, NULL ); |
|
板凳#
发布于:2009-06-02 07:07
|
|
地板#
发布于:2009-06-02 07:10
还有,我把其中的 FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET | FLTFL_IO_OPERATION_NON_CACHED换成:
FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 或者 FLTFL_IO_OPERATION_NON_CACHED,都不好使,郁闷! ![]() |
|
地下室#
发布于:2009-06-02 07:15
Generally I don't think adding trailer in pre-cleanup is a good idea since file cache could be flushed in CLEANUP.
There are restrictions for non-cache write. It must be sector aligned. Check WDK document for details. |
|
5楼#
发布于:2009-06-02 11:43
michaelgz 能提供一个好思路吗?
![]() |
|
6楼#
发布于:2009-06-05 09:00
sizeof(FILE_MARK_INFO)是sector的倍数么?
|
|