douzj
驱动牛犊
驱动牛犊
  • 注册日期2010-01-25
  • 最后登录2010-05-24
  • 粉丝0
  • 关注0
  • 积分2分
  • 威望11点
  • 贡献值0点
  • 好评度0点
  • 原创分0分
  • 专家分0分
阅读:1301回复:0

求助:关于隐藏文件头的读写偏移的问题

楼主#
更多 发布于:2010-05-17 14:52
小弟正在学习楚狂人的《寒江独钓:windows内核安全编程》,遇到一事很不明了,希望得到各位高手的帮助,感激万分。直接进入正题:
相关代码如下:
void CFIrpReadPre(PIRP irp,PIO_STACK_LOCATION irpsp)
{
PLARGE_INTEGER offset;
PFCB fcb = (PFCB)irpsp->FileObject->FsContext;
offset = &irpsp->Parameters.Read.ByteOffset;
if(offset->LowPart == FILE_USE_FILE_POINTER_POSITION && offset->HighPart == -1)
{
// 请问当这种情况下怎样修改文件的偏移?
ASSERT(FALSE);
}
// 偏移必须修改为增加4k。
offset->QuadPart += CF_FILE_HEADER_SIZE;
KdPrint(("CFIrpReadPre: offset = %8x\r\n",
offset->LowPart));
}
从WDK中找到的相关资料:
IrpSp->Parameters.Read.ByteOffset
Pointer to a LARGE_INTEGER variable that specifies the starting byte offset within the file of the data to be read.
Under certain circumstances, this parameter might validly contain a NULL or negative value. For example, if the file object was opened for synchronous I/O, and one of the following conditions is true, this indicates that the current file position should be used instead of an explicit file offset value:

IrpSp->Parameters.Read.ByteOffset.QuadPart == 0

IrpSp->Parameters.Read.ByteOffset.LowPart == FILE_USE_FILE_POINTER_POSITION and
IrpSp->Parameters.Read.ByteOffset.HighPart == -1.

恳请各位高手的赐教!
游客

返回顶部