阅读:954回复:1
IRP_MJ_READ设置完成例程后,如何访问里面的数
if ( currentIrpStack->MajorFunction == IRP_MJ_READ )
{ do{ ////////////////////////////////////////////////////////////////////////////////////// //过滤 //非页读写,略过处理 if (! (Irp->Flags & (IRP_NOCACHE | IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO))) { DbgPrint("0_1"); break; } //非指定的进程名, 略过处理 if ( !ApplyFilters( (char*)name ) ) { DbgPrint("0_3"); break; } ///////////////////////////////////////////////////////////////////////////////////// //填充ReadCompletion参数信息 Length = currentIrpStack->Parameters.Read.Length; if (Irp->MdlAddress) { DbgPrint("1_5"); OldBuffer = MmGetSystemAddressForMdl(Irp->MdlAddress); } else { DbgPrint("1_7"); OldBuffer = Irp->UserBuffer; } if ( !OldBuffer){DbgPrint("1_2"); break;} //分配一个可用页,从全局页表中 PCompletionCtx = ExAllocateFromNPagedLookasideList(&gReadWriteCompletionCtxLookAsideList); if ( !PCompletionCtx ) { DbgPrint("1_4"); break; } //分配用于自己操作的内存区MyBuffer MyBuffer = ExAllocatePoolWithTag(NonPagedPool, currentIrpStack->Parameters.Write.Length, SFLT_POOL_TAG); if (!MyBuffer) { DbgPrint("1_4"); ExFreePool(PCompletionCtx); break; } PCompletionCtx->MyBuffer = MyBuffer; PCompletionCtx->OldBuffer = OldBuffer; PCompletionCtx->OldMdl = Irp->MdlAddress; PCompletionCtx->Length = Length; IoSetCompletionRoutine(Irp , ReadCompleted, PCompletionCtx ,TRUE ,TRUE ,TRUE ); }while(FALSE); } status = IoCallDriver( hookExt->FileSystem, Irp ); return status; } |
|
|
沙发#
发布于:2007-08-29 17:26
访问MyBuffer出错, 蓝屏
NTSTATUS ReadCompleted( PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context ) { PREAD_COMPLETION_CONTEXT CompletionCtx = (PREAD_COMPLETION_CONTEXT) Context; ULONG Offset = 0; ULONG i=0; for (Offset = 0; Offset < CompletionCtx->Length; ++Offset) { ((PUCHAR) CompletionCtx->MyBuffer)[Offset] = ((PUCHAR) CompletionCtx->OldBuffer)[Offset] - 1; } DbgPrint("ReadCompleted"); // DbgPrint("%s", CompletionCtx->MyBuffer); //这里访问蓝屏,那怎么处里读到的数据呀 if (Irp->PendingReturned) { IoMarkIrpPending(Irp); } // DbgPrint("ReadCompleted"); ExFreePoolWithTag(CompletionCtx->MyBuffer, SFLT_POOL_TAG); ExFreeToNPagedLookasideList(&gReadWriteCompletionCtxLookAsideList, CompletionCtx); return STATUS_SUCCESS; } |
|
|