如何判断文件是不是被映射了？

  现在碰到文件被映射了以后，调用CcPurgeCacheSection死锁了。请大家帮忙。


最近也在驱动网学到好多东西，无以为报，上传一个通配符匹配函数供大家学习参考。经我随机测试，复杂度是M+N，但后来想想再快也快不过字符串查找，而一个特定的字符串查找复杂度可达到M*N。我现在的文件过滤驱动文件名和进程名匹配是靠这个来的。

感谢

Memory-mapping is handled entirely by the Memory Manager. The Cache Manager uses services provided by the Memory Manager, not vice-versa. A file can quite easily have valid pointers in the FileObject->SectionObjectPointer->DataSectionObject or FileObject->SectionObjectPointer->ImageSectionObject fields (which means that the file may be mapped somewhere) but have a NULL pointer at FileObject->SectionObjectPointer->SharedCacheMap (whichs means that the file is not cached by Cc).

if the file is memory mapped, the cache cannot be purged.

谢了楼上

感谢搂主

MatchingString有现成的函数：FsRtlIsNameInExpression，