阅读:2574回复:8
sfilter文件加密新问题,请大家给我解决下
我这个加密的结果也就是保存文件都是明文,不是密文,请大家给我看看阿,还有打开的文件也都是明文。怎么办啊
void RC(unsigned char * pBuffer, int iBufferLen) { unsigned short counter; counter = 0; for(counter = 0; counter < iBufferLen; counter ++) { pBuffer[counter] = \'a\'+1;//~pBuffer[counter]; } counter=counter; } NTSTATUS SpyRead( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { PDEVICE_EXTENSION extension; PDEVICE_OBJECT attachedDevice; PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp); NTSTATUS status; ULONG l1; PFILE_OBJECT file = irpSp->FileObject; LARGE_INTEGER offset = irpSp->Parameters.Read.ByteOffset; ULONG length = irpSp->Parameters.Read.Length; PVOID pTempBuffer; if((DeviceObject == gControlDeviceObject)||length==0) { DbgPrint(\"xxexit\"); return SpyPassThrough( DeviceObject, Irp ); } extension = DeviceObject->DeviceExtension; attachedDevice = extension->NextDriverDeviceObject; if(extension->NextDriverDeviceObject==NULL) { IoSkipCurrentIrpStackLocation(Irp); DbgPrint(\"xx111111111eeeee1\"); return IoCallDriver(attachedDevice,Irp); } if (Irp->MdlAddress) { pTempBuffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority); } else { pTempBuffer = Irp->UserBuffer; } IoSkipCurrentIrpStackLocation(Irp); status = IoCallDriver(attachedDevice,Irp); length = Irp->IoStatus.Information; if(length>0) RC(pTempBuffer,length ); l1 = Irp->IoStatus.Information; DbgPrint(\"begin SpyRead ½âÃÜ=%d\\n\",l1); return status; } NTSTATUS SfErp( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context ) { PGB data; PVOID pTempBuffer; if (Irp->MdlAddress) { pTempBuffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority); } else { pTempBuffer = Irp->UserBuffer; } data =(PGB)Context; RtlCopyMemory(data->dest ,data->source, data->Len); ExFreePool(data->source); ExFreePool(data); if (Irp->PendingReturned) { IoMarkIrpPending( Irp ); } return STATUS_SUCCESS; } NTSTATUS SpyWrite( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { PDEVICE_EXTENSION extension; PDEVICE_OBJECT attachedDevice; PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp); NTSTATUS status; PFILE_OBJECT file = irpSp->FileObject; LARGE_INTEGER offset = irpSp->Parameters.Write.ByteOffset; ULONG length = irpSp->Parameters.Write.Length; ULONG l1; PVOID pTempBuffer; PVOID SysDataBufFirst; PGB data; PIO_STACK_LOCATION nextIrpSp; if(DeviceObject == gControlDeviceObject||length==0) { DbgPrint(\"xx²»ÐèÒª¼ÓÃÜ exit\\n\"); return SpyPassThrough( DeviceObject, Irp ); } // if(1||Irp->Flags&IRP_NOCACHE||Irp->Flags&IRP_PAGING_IO||Irp->Flags&IRP_SYNCHRONOUS_PAGING_IO) if((Irp->Flags & IRP_PAGING_IO) || (Irp->Flags & IRP_SYNCHRONOUS_PAGING_IO) || (Irp->Flags & IRP_NOCACHE)) { extension = DeviceObject->DeviceExtension; attachedDevice = extension->NextDriverDeviceObject; if(extension->NextDriverDeviceObject==NULL) { IoSkipCurrentIrpStackLocation(Irp); return IoCallDriver(attachedDevice,Irp); } if (Irp->MdlAddress) { pTempBuffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority); } else { pTempBuffer = Irp->UserBuffer; } DbgPrint(\"¿ªÊ¼¼ÓÃÜ exit\\n\"); SysDataBufFirst = ExAllocatePool(NonPagedPool,length); RtlCopyMemory(SysDataBufFirst,pTempBuffer,length); RC(pTempBuffer,length); /* nextIrpSp = IoGetNextIrpStackLocation( Irp ); RtlMoveMemory( nextIrpSp, irpSp, sizeof( IO_STACK_LOCATION ) ); */ IoCopyCurrentIrpStackLocationToNext(Irp); data = ExAllocatePool(NonPagedPool,sizeof(GB)); data->source= SysDataBufFirst; data->dest = pTempBuffer; data->Len = length; IoSetCompletionRoutine( Irp, SfErp, (PGB)data, TRUE, TRUE, TRUE ); status=IoCallDriver(attachedDevice,Irp); l1 = Irp->IoStatus.Information; /* CcFlushCache(irpSp->FileObject->SectionObjectPointer,NULL,0,NULL); CcPurgeCacheSection(irpSp->FileObject->SectionObjectPointer,NULL,0,TRUE); */ DbgPrint(\"begin SpyRead sparcle ¼ÓÃÜ=%d\\n\",l1); return status; } else { DbgPrint(\"²ÎÊý²»¶Ô,²»ÐèÒª¼ÓÃÜ exit\\n\"); return SpyPassThrough( DeviceObject, Irp ); } } |
|
最新喜欢:aasa2 |
沙发#
发布于:2005-02-24 21:17
read解密最好在完成历程中处理。
|
|
|
板凳#
发布于:2005-02-24 21:29
这个程序就是在把其他分区的内容拷贝到加密盘时就出现错误
页中断 错误号3 其他都好像可以的 |
|
地板#
发布于:2005-02-24 21:36
word可以吗?
|
|
|
地下室#
发布于:2005-02-25 16:47
刷新cache了吗,我以前也出现过这种情况,读取出来的总是明文,其实磁盘上存放的是密文,只不过文件被打开一次以后就在cache当中了,以后再打开就是明文。
|
|
5楼#
发布于:2005-03-01 19:47
如何刷新cache,可不可以给我个例子阿,谢谢楼上的
|
|
6楼#
发布于:2005-03-01 21:35
如何刷新cache,可不可以给我个例子阿,谢谢楼上的 CcFlushCache:刷新高速缓存中的数据到磁盘上; CcPurgeCacheSection:要清空高速缓存中的数据使用。 |
|
|
7楼#
发布于:2005-03-02 12:33
CcFlushCache:刷新高速缓存中的数据到磁盘上; CcPurgeCacheSection:要清空高速缓存中的数据使用 这几个函数在那里用阿 fslife给一个实例阿 |
|
8楼#
发布于:2005-03-02 13:33
这个很简单的,可以将它们放在IRP_MJ_CLOSE的处理例程里。
下面是它们的声明: NTKERNELAPI BOOLEAN CcPurgeCacheSection ( IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN PLARGE_INTEGER FileOffset OPTIONAL, IN ULONG Length, IN BOOLEAN UninitializeCacheMaps ); NTKERNELAPI VOID CcFlushCache ( IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN PLARGE_INTEGER FileOffset OPTIONAL, IN ULONG Length, OUT PIO_STATUS_BLOCK IoStatus OPTIONAL ); |
|
|