阅读:1825回复:3
IRP_MJ_DIRECTORY_CONTROL的处理函数导致文件夹打不开
我打算用sfilter的代码来实现文件的隐藏,打算在sfilter的基础上修改,因此
加入以下一些代码,对DIRECTORY_CONTROL的IRP请求进行过滤,函数中基本什么也没有做,就是设置IRP的完成函数,传递,等待返回。但是加载这个驱动后,点任何文件夹的时候,文件夹的窗口就是一片白的,就象是CPU站用率达到100%的时候你进行操作的样子,但是看任务管理器中cpu占用率很正常。刚开始接触文件驱动,请各位帮我看看下面的代码有什么毛病。 DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = SfDirControl; NTSTATUS SfDirControl ( __in PDEVICE_OBJECT DeviceObject, __in PIRP Irp ) { PIO_STACK_LOCATION pIrp = IoGetCurrentIrpStackLocation( Irp ); PSFILTER_DEVICE_EXTENSION devExt = (PSFILTER_DEVICE_EXTENSION)(DeviceObject->DeviceExtension); KEVENT waitEvent; NTSTATUS status; KeInitializeEvent( &waitEvent, NotificationEvent, FALSE ); IoCopyCurrentIrpStackLocationToNext( Irp ); IoSetCompletionRoutine( Irp, SfDirControlCompletion, &waitEvent, TRUE, TRUE, TRUE ); status = IoCallDriver( devExt->NLExtHeader.AttachedToDeviceObject, Irp ); { NTSTATUS localStatus = KeWaitForSingleObject( &waitEvent, Executive, KernelMode, FALSE, NULL ); ASSERT(STATUS_SUCCESS == localStatus); } //准备在这里进行文件隐藏的处理 status = Irp->IoStatus.Status; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; } NTSTATUS SfDirControlCompletion ( __in PDEVICE_OBJECT DeviceObject, __in PIRP Irp, __in PVOID Context ) { PKEVENT event = Context; UNREFERENCED_PARAMETER( DeviceObject ); UNREFERENCED_PARAMETER( Irp ); ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject )); KeSetEvent(event, IO_NO_INCREMENT, FALSE); return STATUS_MORE_PROCESSING_REQUIRED; } |
|
驱动小牛
|
沙发#
发布于:2007-03-24 00:41
IoCallDriver已经把IRP,complete了.
|
|
板凳#
发布于:2007-03-27 22:09
奇怪
|
|
|
地板#
发布于:2007-06-20 17:24
KeWaitForSingleObject只有当IoCallDriver的status等于STATUS_PENDING才可wait,否则当然CPU占用100%了
|
|