阅读:1301回复:0
求助:关于隐藏文件头的读写偏移的问题
小弟正在学习楚狂人的《寒江独钓:windows内核安全编程》,遇到一事很不明了,希望得到各位高手的帮助,感激万分。直接进入正题:
相关代码如下: void CFIrpReadPre(PIRP irp,PIO_STACK_LOCATION irpsp) { PLARGE_INTEGER offset; PFCB fcb = (PFCB)irpsp->FileObject->FsContext; offset = &irpsp->Parameters.Read.ByteOffset; if(offset->LowPart == FILE_USE_FILE_POINTER_POSITION && offset->HighPart == -1) { // 请问当这种情况下怎样修改文件的偏移? ASSERT(FALSE); } // 偏移必须修改为增加4k。 offset->QuadPart += CF_FILE_HEADER_SIZE; KdPrint(("CFIrpReadPre: offset = %8x\r\n", offset->LowPart)); } 从WDK中找到的相关资料: IrpSp->Parameters.Read.ByteOffset Pointer to a LARGE_INTEGER variable that specifies the starting byte offset within the file of the data to be read. Under certain circumstances, this parameter might validly contain a NULL or negative value. For example, if the file object was opened for synchronous I/O, and one of the following conditions is true, this indicates that the current file position should be used instead of an explicit file offset value: IrpSp->Parameters.Read.ByteOffset.QuadPart == 0 IrpSp->Parameters.Read.ByteOffset.LowPart == FILE_USE_FILE_POINTER_POSITION and IrpSp->Parameters.Read.ByteOffset.HighPart == -1. 恳请各位高手的赐教! |
|