阅读:2594回复:3
请教下关于基于MFC的minifilter的测试应用程序的问题
按照shenhui大侠的提示,先建立连接,再发送消息,发送消息过后,就可以实现加解密了?为什么我的程序编译通过了,并没有实现加密功能?那个驱动已经改过了,是可以实现加密功能的。。。。
|
|
沙发#
发布于:2010-11-26 18:00
回 楼主(ssfy308) 的帖子
1. 加载驱动FilterLoad(...) 2. 建立与驱动通信的通道 FilterConnectCommunicationPort(...) 3. 设置system进程和explorer.exe进程 MSG_SEND_ADD_PROCESS_INFO sSendAddProcInfo ; memset(&sSendAddProcInfo, 0, sizeof(sSendAddProcInfo)) ; sSendAddProcInfo.sSendType.uSendType = IOCTL_ADD_PROCESS_INFO ; sSendAddProcInfo.sProcInfo.bMonitor = TRUE; strncpy(sSendAddProcInfo.sProcInfo.szProcessName, "system", strlen("system")) ; MSG_GET_ADD_PROCESS_INFO sGetAddProcInfo ; memset(&sGetAddProcInfo, 0, sizeof(MSG_GET_ADD_PROCESS_INFO)) ; hRes = FilterSendMessage(hPort, &sSendAddProcInfo, sizeof(MSG_SEND_ADD_PROCESS_INFO), &sGetAddProcInfo, sizeof(MSG_GET_ADD_PROCESS_INFO), &dwReturned) ; MSG_SEND_ADD_PROCESS_INFO sSendAddProcInfo ; memset(&sSendAddProcInfo, 0, sizeof(sSendAddProcInfo)) ; sSendAddProcInfo.sSendType.uSendType = IOCTL_ADD_PROCESS_INFO ; sSendAddProcInfo.sProcInfo.bMonitor = TRUE; strncpy(sSendAddProcInfo.sProcInfo.szProcessName, "explorer.exe", strlen("explorer.exe")) ; MSG_GET_ADD_PROCESS_INFO sGetAddProcInfo ; memset(&sGetAddProcInfo, 0, sizeof(MSG_GET_ADD_PROCESS_INFO)) ; hRes = FilterSendMessage(hPort, &sSendAddProcInfo, sizeof(MSG_SEND_ADD_PROCESS_INFO), &sGetAddProcInfo, sizeof(MSG_GET_ADD_PROCESS_INFO), &dwReturned) ; 4. 设置你要监控的进程(notepad.exe/winword.exe/excel.exe/powerpnt.exe) 方法同3。 通过这四部,就可以进行测试了。 当然结束测试前别忘了关闭与驱动通信的端口,以及调用FilterUnload将驱动卸载。 |
|
板凳#
发布于:2010-11-26 18:04
回 1楼(ssfy308) 的帖子
,第一步,第二步都实现了,已经和驱动建立了连接,第三部和第四步,编译通过了,但是并没有实现加密功能,请问这里还需要要做其他工作?我的第二个按钮主要是第三步和第四步(发送消息),代码是这样的,麻烦帮我看下有什么问题?void CtestFlt2008Dlg::OnBnClickedStart() { // TODO: 在此添加控件通知处理程序代码 ULONG hRes,dwReturned; MSG_SEND_ADD_PROCESS_INFO sSendAddProcInfo ; MSG_GET_ADD_PROCESS_INFO sGetAddProcInfo ; memset(&sSendAddProcInfo, 0, sizeof(sSendAddProcInfo)) ; sSendAddProcInfo.sSendType.uSendType = IOCTL_ADD_PROCESS_INFO ; sSendAddProcInfo.sProcInfo.bMonitor = TRUE; strncpy(sSendAddProcInfo.sProcInfo.szProcessName, "system", strlen("system")) ; memset(&sGetAddProcInfo, 0, sizeof(MSG_GET_ADD_PROCESS_INFO)) ; hRes = FilterSendMessage(port, &sSendAddProcInfo, sizeof(MSG_SEND_ADD_PROCESS_INFO), &sGetAddProcInfo, sizeof(MSG_GET_ADD_PROCESS_INFO), &dwReturned) ; memset(&sSendAddProcInfo, 0, sizeof(sSendAddProcInfo)) ; sSendAddProcInfo.sSendType.uSendType = IOCTL_ADD_PROCESS_INFO ; sSendAddProcInfo.sProcInfo.bMonitor = TRUE; strncpy(sSendAddProcInfo.sProcInfo.szProcessName, "explorer.exe", strlen("explorer.exe")) ; memset(&sGetAddProcInfo, 0, sizeof(MSG_GET_ADD_PROCESS_INFO)) ; hRes = FilterSendMessage(port, &sSendAddProcInfo, sizeof(MSG_SEND_ADD_PROCESS_INFO), &sGetAddProcInfo, sizeof(MSG_GET_ADD_PROCESS_INFO), &dwReturned) ; memset(&sSendAddProcInfo, 0, sizeof(sSendAddProcInfo)) ; sSendAddProcInfo.sSendType.uSendType = IOCTL_ADD_PROCESS_INFO ; sSendAddProcInfo.sProcInfo.bMonitor = TRUE; strncpy(sSendAddProcInfo.sProcInfo.szProcessName, "notepad.exe", strlen("notepad.exe")) ; memset(&sGetAddProcInfo, 0, sizeof(MSG_GET_ADD_PROCESS_INFO)) ; hRes = FilterSendMessage(port, &sSendAddProcInfo, sizeof(MSG_SEND_ADD_PROCESS_INFO), &sGetAddProcInfo, sizeof(MSG_GET_ADD_PROCESS_INFO), &dwReturned) ; } |
|
地板#
发布于:2010-11-29 11:43
![]() ![]() ![]() ![]() |
|