阅读:1556回复:5
怎么在Create之前取到文件全路径?
sfilter的Sfcreate里是在completion后才能取到文件全路径,有啥办法在completion之前就取到文件全路径呢?
|
|
沙发#
发布于:2007-06-03 17:13
WDK的sfilter就可以满足你的要求,而不是IFS 2003 SP1的sfilter!
|
|
|
板凳#
发布于:2007-06-03 21:38
谢了.不过wdk好象不太好下?
|
|
驱动小牛
|
地板#
发布于:2007-06-04 12:50
filespy
|
|
地下室#
发布于:2007-06-23 23:55
sfilter中取文件名的函数 调用中,有一个参数表明调用是否成功,你只要把个参数设置为不成功的一个参数就行了。
|
|
5楼#
发布于:2007-06-26 12:20
你也可参看filemon的代码,从fileobject中取得
VOID GetPathFromObject( PHOOK_EXTENSION hookExt, // 设备扩展,这里较重要的是LogicalDrive,你绑定的卷名 PCHAR fullPathName, PFILE_OBJECT fileObject ) { ANSI_STRING fileName; ANSI_STRING relatedName; ULONG pathLen, prefixLen; PCHAR pathOffset; PFILE_OBJECT relatedFileObject; // // If there is no file name at this point, just return "DEVICE" to indicate // raw access to a device // if( !fileObject->FileName.Buffer ) { if( hookExt->Type == NPFS ) strcpy( fullPathName, NAMED_PIPE_PREFIX ); else if( hookExt->Type == MSFS ) strcpy( fullPathName, MAIL_SLOT_PREFIX ); else sprintf( fullPathName, "%C:", hookExt->LogicalDrive ); return; } fileName.Buffer = NULL; relatedName.Buffer = NULL; // // Create the full path name. First, calculate the length taking into // account space for seperators and the leading prefix // if( !NT_SUCCESS( RtlUnicodeStringToAnsiString( &fileName, &fileObject->FileName, TRUE ))) { if( hookExt->Type == NPFS ) sprintf( fullPathName, "%s: <Out of Memory>", NAMED_PIPE_PREFIX ); else if( hookExt->Type == MSFS ) sprintf( fullPathName, "%s: <Out of Memory>", MAIL_SLOT_PREFIX ); else sprintf( fullPathName, "%C: <Out of Memory>", hookExt->LogicalDrive ); return; } //DbgPrint(("Filemon.sys:FromObject> fileName(Create): %s", fileName.Buffer)); pathLen = fileName.Length + 2; relatedFileObject = fileObject->RelatedFileObject; // // Only look at related file object if this is a relative name // if( fileObject->FileName.Buffer[0] != L'\\' && relatedFileObject && relatedFileObject->FileName.Length ) { if( !NT_SUCCESS( RtlUnicodeStringToAnsiString( &relatedName, &relatedFileObject->FileName, TRUE ))) { if( hookExt->Type == NPFS ) sprintf( fullPathName, "%s: <Out of Memory>", NAMED_PIPE_PREFIX ); else if( hookExt->Type == MSFS ) sprintf( fullPathName, "%s: <Out of Memory>", MAIL_SLOT_PREFIX ); else sprintf( fullPathName, "%C: <Out of Memory>", hookExt->LogicalDrive ); RtlFreeAnsiString( &fileName ); return; } //DbgPrint( ("Filemon.sys:FromObject> RelatedName: %s", relatedName.Buffer) ); pathLen += relatedName.Length+1; } // // Add the drive letter first at the front of the name // if( hookExt->Type == NPFS ) strcpy( fullPathName, NAMED_PIPE_PREFIX ); else if( hookExt->Type == MSFS ) strcpy( fullPathName, MAIL_SLOT_PREFIX ); else if( fileObject->DeviceObject->DeviceType != FILE_DEVICE_NETWORK_FILE_SYSTEM ) { sprintf( fullPathName, "%C:", hookExt->LogicalDrive ); } // // If the name is too long, quit now // if( pathLen >= MAXPATHLEN ) { strcat( fullPathName, " <Name Too Long>" ); } else { // // Now we can build the path name // fullPathName[ pathLen ] = 0; pathOffset = fullPathName + pathLen - fileName.Length; memcpy( pathOffset, fileName.Buffer, fileName.Length + 1 ); if( fileObject->FileName.Buffer[0] != L'\\' && relatedFileObject && relatedFileObject->FileName.Length ) { // // Copy the component, adding a slash separator // *(pathOffset - 1) = '\\'; pathOffset -= relatedName.Length + 1; memcpy( pathOffset, relatedName.Buffer, relatedName.Length ); // // If we've got to slashes at the front zap one // if( pathLen > 3 && fullPathName[2] == '\\' && fullPathName[3] == '\\' ) { strcpy( fullPathName + 2, fullPathName + 3 ); } } } if( fileName.Buffer ) RtlFreeAnsiString( &fileName ); if( relatedName.Buffer ) RtlFreeAnsiString( &relatedName ); } |
|
|