minifilter透明加解密

请教各位达人：为何create计数与close计数不一致（导致文件访问计数不能归0（CTX框架））？
        0 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref=1 NewCreate
        1 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref++=2 NotCreate
        2 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref=1 NewCreate
        3 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref++=2 NotCreate
        4 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref++=3 NotCreate
        5 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref++=4 NotCreate
        6 PreClose FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref--=3
        7 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
        8 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=2 NotCreate
        9 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=3 NotCreate
       10 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=2
       11 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=3 NotCreate
       12 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=4 NotCreate
       13 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=3
       14 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=4 NotCreate
       15 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=5 NotCreate
       16 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=4
       17 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref=1 NewCreate
       18 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref=1 NewCreate
       19 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=2 NotCreate
       20 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=3 NotCreate
       21 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=5 NotCreate
       22 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=4
       23 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref=3
       24 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref--=2
       25 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
       26 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
       27 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=0
       28 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=3 NotCreate
       29 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=4 NotCreate
       30 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref--=3
       31 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
       32 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
       33 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref=1 NewCreate
       34 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=4 NotCreate
       35 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=5 NotCreate
       36 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=2 NotCreate
       37 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=3 NotCreate
       38 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=2
       39 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=6 NotCreate
       40 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref++=7 NotCreate
       41 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRD0000.tmp  Ref--=6
       42 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=1
       43 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=5
       44 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref=1 NewCreate
       45 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=2 NotCreate
       46 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=1
       47 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=2 NotCreate
       48 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=3 NotCreate
       49 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=6 NotCreate
       50 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=7 NotCreate
       51 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=4 NotCreate
       52 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=5 NotCreate
       53 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=4
       54 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref=1 NewCreate
       55 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref++=2 NotCreate
       56 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=3
       57 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=4 NotCreate
       58 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=5 NotCreate
       59 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=4
       60 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=5 NotCreate
       61 PreCreate FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref++=6 NotCreate
       62 PreClose FileName::\Device\HarddiskVolume2\qqq\~WRL0001.tmp  Ref--=5
       63 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref++=4 NotCreate
       64 PreCreate FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref++=5 NotCreate
       65 PreClose FileName::\Device\HarddiskVolume2\qqq\222.doc  Ref--=4
       66 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=8 NotCreate
       67 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=9 NotCreate
       68 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=8
       69 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=9 NotCreate
       70 PreCreate FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref++=10 NotCreate
       71 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=9
       72 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref=1 NewCreate
       73 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref++=2 NotCreate
       74 PreClose FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref--=1
       75 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref++=2 NotCreate
       76 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref++=3 NotCreate
       77 PreClose FileName::\Device\HarddiskVolume2\qqq\~$222a.doc  Ref--=2
       78 PreClose FileName::\Device\HarddiskVolume2\qqq\222a.doc  Ref--=8
       79 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref=1 NewCreate
       80 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref++=2 NotCreate
       81 PreClose FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref--=1
       82 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref++=2 NotCreate
       83 PreCreate FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref++=3 NotCreate
       84 PreClose FileName::\Device\HarddiskVolume2\qqq\~$222.doc  Ref--=2

很正常, CloseHandle 对应到你的 IRP_MJ_Cleanup 而已, 跟 IRP_MJ_close 无直接联系. 所以你 Create 有, 但却迟迟看不到 Close.
你想一下也清楚了, 这是系统cache搞的鬼.