阅读:1551回复:1
Not enough storage is available to process this command????
在做文件标识,遇到的问题
我的步骤: 1.在sfcreate完成函数执行后,read c:\tt111.txt文件的头(文件标识)。 对 2.在SfGetInformation函数中有以下代码: case FileStandardInformation: ((PFILE_STANDARD_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart -= InvisiblePartSize; break; case FileAllInformation: ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->PositionInformation.CurrentByteOffset.QuadPart -= InvisiblePartSize; ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->StandardInformation.EndOfFile.QuadPart -= InvisiblePartSize; break; 3.在sfread中有以下代码: if(IrpSp->Parameters.Read.Length == InvisiblePartSize) //屏蔽读头标识时执行sfread函数中的加解密动作 { IoSkipCurrentIrpStackLocation(Irp); return IoCallDriver(DevExt->NLExtHeader.AttachedToDeviceObject, Irp); } //IrpSp->Parameters.Read.Length -=InvisiblePartSize; IrpSp->Parameters.Read.ByteOffset.QuadPart +=InvisiblePartSize; Length = IrpSp->Parameters.Read.Length ; 4.fastio中我全部类似于下面的处理: BOOLEAN SpyFastIoQueryStandardInfo ( IN PFILE_OBJECT FileObject, IN BOOLEAN Wait, OUT PFILE_STANDARD_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ) { PDEVICE_OBJECT deviceObject; PFAST_IO_DISPATCH fastIoDispatch; PRECORD_LIST recordList; BOOLEAN returnValue = FALSE; BOOLEAN shouldLog; PAGED_CODE(); ASSERT( IS_FILESPY_DEVICE_OBJECT( DeviceObject ) ); return FALSE;//开始就直接返回 5.IRP_MJ_DIRECTORY_CONTROL,我做了下面处理:(不知道为什么,dbg时,发现代码重来没被执行过) if ((dwFileNameLength == OurFileNameLen) && _wcsnicmp(pFileName, OurFileName, OurFileNameLen/2)==0) { //_asm int 3; //Hide first InvisiblePartSize bytes KdPrint(("SFilter!SfGetInformation ERROR:000000000000\n")); ((PFQD_CommonBlock)pQueryDirWin32)->FileAttr.EndOfFile.QuadPart -= InvisiblePartSize; break; } 6.问题: 测试时,打开c:\tt111.txt文件时,出现Not enough storage is available to process this command????窗口 help me |
|
沙发#
发布于:2007-07-23 19:27
FileStandardInformation
FileAllInformation IRP_MJ_DIRECTORY_CONTROL中的IRP_MN_QUERY_DIRECTORY我也处理了(但就是重来没进去过) sfread中也跳过自己读标识的动作了 fastio,我都return FALSE;处理了 能读到文件头标识,但源文件自己打开出错,why??? |
|