阅读:2152回复:2
【求助】微过滤中FltCreateFile失败是为何?
FLT_PREOP_CALLBACK_STATUS
ccxPreCreate( __inout PFLT_CALLBACK_DATA Data, __in PCFLT_RELATED_OBJECTS FltObjects, __deref_out_opt PVOID *CompletionContext ) { ......................... HANDLE hFile=NULL; path.Buffer=ExAllocatePoolWithTag(NonPagedPool,length+4,CCX_MEM_TAG); path.Length=0; path.MaximumLength=(USHORT)length+4; if(path.Buffer==NULL) { status=STATUS_INSUFFICIENT_RESOURCES; ret=FLT_PREOP_COMPLETE; break; } memset(path.Buffer,0,path.MaximumLength); //将路径复制到缓冲区中 length=ccx_get_path(Data,&path); hFile=ccxOpenFile(FltObjects->Filter,FltObjects->Instance,&path,Data->Iopb,&status,&myfile,&information); ......................................... //调用打开文件: //-------------------------------------------------------------- HANDLE ccxOpenFile( IN PFLT_FILTER Filter, IN PFLT_INSTANCE Instance, IN PUNICODE_STRING path, IN PFLT_IO_PARAMETER_BLOCK irpsp, OUT NTSTATUS *status, OUT PFILE_OBJECT *file, OUT PULONG information) { HANDLE hFile=NULL; OBJECT_ATTRIBUTES oi; IO_STATUS_BLOCK iostatus; //---------------------------------------------------------------------------------------------------- ULONG desired_access=irpsp->Parameters.Create.SecurityContext->DesiredAccess; ULONG disposition=irpsp->Parameters.Create.Options>>24; ULONG share_access=irpsp->Parameters.Create.ShareAccess; ULONG file_attri=irpsp->Parameters.Create.FileAttributes; ULONG create_options=irpsp->Parameters.Create.Options && 0x00ffffff; ULONG EaLength=irpsp->Parameters.Create.EaLength; PVOID EaBuffer=irpsp->Parameters.Create.EaBuffer; ULONG Flags=IO_IGNORE_SHARE_ACCESS_CHECK; //---------------------------------------------------------------------------------------------------- ASSERT(irpsp->MajorFunction==IRP_MJ_CREATE); *information=0; InitializeObjectAttributes(&oi,path,OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,NULL,NULL); DbgPrint("文件名2:%wZ\n",path); //这里有输出完整的文件名 *status=FltCreateFile(Filter,Instance,&hFile,desired_access,&oi,&iostatus, (PLARGE_INTEGER)0,file_attri,share_access,disposition,create_options,EaBuffer,EaLength,Flags); if(!NT_SUCCESS(*status)) { DbgPrint("打开文件失败:%08X\n",*status); return hFile; } //---------------------------------------------------------------------------------------------------- *information=iostatus.Information; //从文件句柄获取FileObject以方便后面的操作 *status=ObReferenceObjectByHandle( hFile,0,*IoFileObjectType,KernelMode,file,NULL); if(!NT_SUCCESS(*status)) //ASSERT(FALSE); ZwClose(hFile); } return hFile; } //------------------------------------------- 问题: 1。这段代码是放在PreCreate中的 用FltCreateFile失败,返回0xC000000D,文件名输出无问题,缓冲区也足够大 2.换成*status=ZwCreateFile(&hFile,desired_access,&oi,&iostatus,(PLARGE_INTEGER)0,file_attri,share_access, disposition,create_options,EaBuffer,EaLength); 也一样失败,会蓝屏。 不知是什么原因? |
|
沙发#
发布于:2012-12-26 08:23
文件名是不是盘符开头的文件名
|
|
板凳#
发布于:2013-01-11 10:35
代码没有细看。。。打开的文件名是否是跨盘?如果是跨盘那就是fileobject的问题,,也就是fltcreatefile第二个参数的问题。。。
|
|