阅读:1373回复:3
tooflat加密代码里,SfEncryptDecryptFileByFileObject在哪定义
我是个新手,看了tooflat的代码,加密似乎是在SfEncryptDecryptFileByFileObject里做的,
但这个函数在sfilter.c里没有实现,好像在ifs里也没有?有些奇怪。请指教,谢谢! |
|
沙发#
发布于:2007-04-25 09:34
Re:tooflat加密代码里,SfEncryptDecryptFileByFileObj
下载的代码估计有缺失!NTSTATUS SfEncryptDecryptFileByFileObject( IN PDEVICE_OBJECT DeviceObject, IN PFILE_OBJECT FileObject ) { IO_STATUS_BLOCK IoStatus = {0}; NTSTATUS Status; UCHAR Buffer[512] = {'\0'}; LARGE_INTEGER ByteOffset; ULONG Offset = 0; BOOLEAN EndOfFile = FALSE; ByteOffset.QuadPart = 0; while (TRUE) { IoStatus.Status = STATUS_SUCCESS; IoStatus.Information = 0; Status = SfIssueReadWriteIrpSynchronously( DeviceObject, FileObject, IRP_MJ_READ, &IoStatus, Buffer, sizeof(Buffer), &ByteOffset, 0 ); if (!NT_SUCCESS(Status)) { if (STATUS_END_OF_FILE == Status) Status = STATUS_SUCCESS; break; } if (0 == IoStatus.Information) break; if (IoStatus.Information < sizeof(Buffer)) EndOfFile = TRUE; Status = SfIssueReadWriteIrpSynchronously( DeviceObject, FileObject, IRP_MJ_WRITE, &IoStatus, Buffer, IoStatus.Information, &ByteOffset, 0 ); if (!NT_SUCCESS(Status)) { if (STATUS_END_OF_FILE == Status) Status = STATUS_SUCCESS; break; } if (EndOfFile) break; ByteOffset.QuadPart += sizeof(Buffer); } return Status; } |
|
|
板凳#
发布于:2007-04-25 10:56
下载个全的,置顶帖子里就有。
|
|
地板#
发布于:2007-04-25 14:38
thank you very much.
I re-downloaded the file and it seems well |
|