阅读:5310回复:9
我的驱动里面怎么使用QueryDosDevice函数
不好意思,弄烦我了。
我开始以为不好用,但在驱动网上面搜了一下,发现很多人用QueryDosDevice这个函数的,就是没有说怎么用。 用MmGetSystemRoutineAddress取函数地址有问题,只能去kernel和hal里面定义的。 究竟怎么用,还请牛们赐教了。 |
|
|
沙发#
发布于:2008-01-11 09:21
不至于不管我吧,
起码说个可以替代的方法啊。 |
|
|
板凳#
发布于:2008-01-11 10:20
搞笑嗦。你说出ZwQueryVolumeInformationFile来呢。
我也知道他是上层的啊。 要不要代码,各位?代会呈上,新鲜得很。 |
|
|
地板#
发布于:2008-01-11 16:07
各位,我的实现函数如下,是用的ZwQuerySymbolicLinkObject函数。
NTSTATUS ZwMyQueryDosName(wchar_t chLable, wchar_t* strDosName, ULONG* ulSize) { NTSTATUS status; UNICODE_STRING tarName; UNICODE_STRING symName; HANDLE hSymbol = NULL; OBJECT_ATTRIBUTES objectAttributes; wchar_t strName[32]; ULONG nLen = sizeof strName; int bReAllocate = 0; try{ RtlInitUnicodeString(&symName, L"\\??\\C:"); symName.Buffer[4] = chLable; InitializeObjectAttributes( &objectAttributes, &symName, OBJ_CASE_INSENSITIVE, NULL, NULL ); status = ZwOpenSymbolicLinkObject(&hSymbol, GENERIC_READ, &objectAttributes); if(!NT_SUCCESS(status)) return status; RtlInitEmptyUnicodeString(&tarName, strName, sizeof strName); status = ZwQuerySymbolicLinkObject(hSymbol, &tarName, &nLen); if(!NT_SUCCESS(status)){ if(STATUS_BUFFER_TOO_SMALL == status){ if(*ulSize < nLen){ *ulSize = nLen; return STATUS_BUFFER_TOO_SMALL; } bReAllocate = 1; tarName.Buffer = ExAllocatePool(NonPagedPool, nLen); if(NULL == tarName.Buffer) return STATUS_INSUFFICIENT_RESOURCES; tarName.MaximumLength = (USHORT)nLen; status = ZwQuerySymbolicLinkObject(hSymbol, &tarName, &nLen); } if(!NT_SUCCESS(status)){ return status; } } // Store the dos device name to input buffer. if(*ulSize <nLen){ *ulSize = nLen; return STATUS_BUFFER_TOO_SMALL; } else{ *ulSize = nLen; wcsncpy(strDosName, (const wchar_t*)tarName.Buffer, tarName.Length/sizeof(wchar_t)); } }finally{ if(0 != bReAllocate) ExFreePool(tarName.Buffer); if(NULL != hSymbol) ZwClose(hSymbol); } return status; } |
|
|
地下室#
发布于:2008-01-12 07:12
OK, thanks rayYang2000.
Durig these functions, I have used IoVolumeDeviceToDosName, but got a strange result. Total these functions should got the FILE_OBJECT object, looks not simple. There must be mistakes when I use IoVolumeDeviceToDosName. I'll try again. But ZwMyQueryDosName does operate. |
|
|