阅读:1554回复:0
filespy 加密读写问题 谢谢各位大哥了 :-(
DBGSTATIC
BOOLEAN SpyFastIoRead( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, OUT PVOID Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ) { PDEVICE_OBJECT deviceObject; PFAST_IO_DISPATCH fastIoDispatch; BOOLEAN returnValue; PRECORD_LIST recordList; BOOLEAN shouldLog; /////////***************************************/////////////// PCHAR pBuffer; int i; //建立数据 PAGED_CODE(); if (DeviceObject->DeviceExtension == NULL) { return FALSE; } if (shouldLog = SHOULD_LOG(DeviceObject)) { // // Log the necessary information for the start of the Fast I/O operation // recordList = SpyLogFastIoStart( //添加操作过程到列表中 READ, 0, FileObject, FileOffset, Length, Wait ); } // // Pass through logic for this type of Fast I/O // deviceObject = ((PDEVICE_EXTENSION) (DeviceObject->DeviceExtension))-> NextDriverDeviceObject; //获得我们想挂接的对象的设备对像 if (!deviceObject) { returnValue = FALSE; goto SpyFastIoRead_Exit; } fastIoDispatch = deviceObject->DriverObject->FastIoDispatch; // 过滤数据我想在这里解密读取的数据为什么不起作用啊 pBuffer = Buffer; for(i =0 ;i > 64 ;i++) { pBuffer = ~pBuffer; } Buffer = pBuffer; if (VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoRead )) { returnValue = (fastIoDispatch->FastIoRead)( FileObject, FileOffset, Length, Wait, LockKey, Buffer, IoStatus, deviceObject); goto SpyFastIoRead_Exit; } else { returnValue = FALSE; goto SpyFastIoRead_Exit; } SpyFastIoRead_Exit: if (shouldLog) { // // Log the necessary information for the end of the Fast I/O operation // if we were able to allocate a RecordList to store this information // if (recordList) { SpyLogFastIoComplete( 0, FileObject, IoStatus, recordList); } } return returnValue; } :D |
|