自己的读写irp，flags用什么合适？

  我用楚狂人文件中的经典irp->flags=0x43

异步发送用IoBuildAsynchronousFsdRequest时，读写操作无效（Iostatus->status和Iostatus->Information都是0）

同步发送用IoBuildAsynchronousFsdRequest时，直接蓝屏，错误为irpl太高，不能写内存

用toolflat的方法，将irpflags都是cache的，不便于控制读写标志，咋办？

如果是为了防止重入，自己把Irp记入list进行判断即可。或者用shadowDO更简单

1. Flag用什么值和你的意图直接相关；
2. 使用IRP_NONCACHE标志是有条件的，再者0x43是什么意思得搞清楚，不能简单的copy/paste；

1。我的意图是越过cache，直接读写磁盘数据。
2。0x43是读写历程中那三个经典flags的组合，我调试发现好像真正disk读写都是0x43。

使用IRP_NONCACHE标志类似于ZwCreateFile中使用FILE_NO_INTERMEDIATE_BUFFERING标志：
其注意事项如下：

The FILE_NO_INTERMEDIATE_BUFFERING CreateOptions flag prevents the file system from performing any intermediate buffering on behalf of the caller. Specifying this flag places the following restrictions on the caller's parameters to other ZwXxxFile routines.

Any optional ByteOffset passed to ZwReadFile or ZwWriteFile must be a multiple of the sector size.
The Length passed to ZwReadFile or ZwWriteFile must be an integral of the sector size. Note that specifying a read operation to a buffer whose length is exactly the sector size might result in a lesser number of significant bytes being transferred to that buffer if the end of the file was reached during the transfer.
Buffers must be aligned in accordance with the alignment requirement of the underlying device. To obtain this information, call ZwCreateFile to get a handle for the file object that represents the physical device, and pass that handle to ZwQueryInformationFile. For a list of the system's FILE_XXX_ALIGNMENT values, see DEVICE_OBJECT.
Calls to ZwSetInformationFile with the FileInformationClass parameter set to FilePositionInformation must specify an offset that is a multiple of the sector size.