阅读:1303回复:0
filemon的疑惑![]() VOID UnhookSpecialFs( FILE_SYSTEM_TYPE FsType ) { PHOOK_EXTENSION hookExt; if( FsType == NPFS && NamedPipeHookDevice ) { hookExt = NamedPipeHookDevice->DeviceExtension; hookExt->Hooked = FALSE; NamedPipeHookDevice = NULL; } else if( FsType == MSFS && MailSlotHookDevice ) { hookExt = MailSlotHookDevice->DeviceExtension; hookExt->Hooked = FALSE; MailSlotHookDevice = NULL; } } 很奇怪的是这里简单的的把设备对象的hook标志设置为false以及把指针设置为null,并没有做额外的DetachDevice和DeleteDevice操作。。。。而在HookSpecialFs函数中,又会重新创建设备对象,进而attach到文件对象设备堆栈上,请问各位大大,这样做对吗,还是我理解的有问题!! ![]() |
|