FileMon中的Hash表算法代码

     这个hash表算法，不是很复杂。不过对于学习还是不错的选择。现在把代码贴下：

 

    这里定义了每个hash项的结构，以及hash桶的计算。

 

//// Structure for the fileobject/name hash table//typedef struct _nameentry { PFILE_OBJECTFileObject; struct _nameentry *Next; CHARFullPathName[];} HASH_ENTRY, *PHASH_ENTRY;//// Number of hash buckets in the hash table//#define NUMHASH0x100//// Hash function. Basically chops the low few bits of the file object//#if defined(_IA64_) #define HASHOBJECT(_fileobject)(((ULONG_PTR)_fileobject)>>5)%NUMHASH#else#define HASHOBJECT(_fileobject)(((ULONG)_fileobject)>>5)%NUMHASH#endif

 

下面这部分为hash清空，删除的代码。

 //----------------------------------------------------------------------// H A S H T A B L E M A N A G E M E N T//----------------------------------------------------------------------//----------------------------------------------------------------------//// FilemonHashCleanup//// Called when we are unloading to free any memory that we have // in our possession.////----------------------------------------------------------------------VOIDFilemonHashCleanup( VOID ){ PHASH_ENTRYhashEntry, nextEntry; ULONG i; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); // // Free the hash table entries // for( i = 0; i < NUMHASH; i++ ) { hashEntry = HashTable[i]; while( hashEntry ) { nextEntry = hashEntry->Next; ExFreePool( hashEntry ); hashEntry = nextEntry; } HashTable[i] = NULL; } ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion();}//----------------------------------------------------------------------//// FilemonFreeHashEntry//// When we see a file close, we can free the string we had associated// with the fileobject being closed since we know it won't be used// again.////----------------------------------------------------------------------VOID FilemonFreeHashEntry( PFILE_OBJECT fileObject ){ PHASH_ENTRYhashEntry, prevEntry; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); // // Look-up the entry // hashEntry = HashTable[ HASHOBJECT( fileObject ) ]; prevEntry = NULL; while( hashEntry && hashEntry->FileObject != fileObject ) { prevEntry = hashEntry; hashEntry = hashEntry->Next; } // // If we fall of the hash list without finding what we're looking // for, just return. // if( !hashEntry ) { ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); return; } // // Got it! Remove it from the list // if( prevEntry ) { prevEntry->Next = hashEntry->Next; } else { HashTable[ HASHOBJECT( fileObject )] = hashEntry->Next; } // // Free the entry's memory // ExFreePool( hashEntry ); ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion();}

 

 

下面这段代码是在函数中向hash表添加项的过程。大致的意思就是首先找到桶的位置，然后在这个桶下的列表中添加就行了。

 

 

PHASH_ENTRY hashEntry, newEntry; // // Allocate a hash entry // newEntry = ExAllocatePool( NonPagedPool, sizeof(HASH_ENTRY ) + strlen( fullPathName ) + 1); // // If no memory for a new entry, oh well. // if( newEntry ) { // // Fill in the new entry // newEntry->FileObject = fileObject; strcpy( newEntry->FullPathName, fullPathName ); // // Put it in the hash table // KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); newEntry->Next = HashTable[ HASHOBJECT(fileObject) ]; HashTable[ HASHOBJECT(fileObject) ] = newEntry; ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); }

 

下面是hash表的定义，以及初始化过程：

 

//// Hash table for keeping names around. This is necessary because // at any time the name information in the fileobjects that we// see can be deallocated and reused. If we want to print accurate// names, we need to keep them around ourselves. //PHASH_ENTRY HashTable[NUMHASH]; // // Initialize the name hash table // for(i = 0; i < NUMHASH; i++ ) HashTable[i] = NULL;