阅读:2810回复:5
MINIFILTER中为什么不能在preRead中读写文件
我在swapbuffer的preread例程中想读一个文件,为什么总是失败?有人知道吗?
WCHAR PipeName[] = L"\\Device\\HarddiskVolume1\\a.txt"; UNICODE_STRING FullFileName; RtlInitUnicodeString( &FullFileName, PipeName ); InitializeObjectAttributes ( &ObjectAttributes, &FullFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL ); ntStatus = FltCreateFile( FltObjects->Filter, FltObjects->Instance, &f_handle, GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE, &ObjectAttributes, &IoStatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_ALERT, NULL, 0, IO_IGNORE_SHARE_ACCESS_CHECK ); if(!NT_SUCCESS(ntStatus)) { sprintf(dbgstr,"FltCreateFile fail status = %X",ntStatus); DbgPrint(dbgstr); return retValue; } else { DbgPrint("open a.txt success"); } ntStatus = ObReferenceObjectByHandle( f_handle, //Handle 0, //DesiredAccess NULL, //ObjectType KernelMode, //AccessMode &handleFileObject, //Object NULL); //HandleInformation if(!NT_SUCCESS(ntStatus)) { DbgPrint("ObReferenceObjectByHandle fail"); return retValue; } else { DbgPrint("ObReferenceObjectByHandle success"); } ntStatus = FltReadFile( FltObjects->Instance, &handleFileObject, &byteOffset, 256, buf, FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET, NULL, NULL, NULL ); if(NT_SUCCESS(ntStatus)) { sprintf(dbgstr,"read file content = %s",buf); } else { DbgPrint("read fail"); } FltClose(f_handle); |
|
沙发#
发布于:2010-03-03 09:13
FltCreateFile中把输入参数 FltObjects->Instance 改成 NULL。
|
|
板凳#
发布于:2010-03-03 18:02
仍然不行啊
|
|
地板#
发布于:2010-03-04 09:20
查查msdn中对FltCreateFile返回值的描述吧
|
|
地下室#
发布于:2010-03-04 10:38
返回值是成功的,就是FLTREADFILE总是失败
|
|
5楼#
发布于:2010-03-05 08:45
改用ZwReadFile
|
|