FltGetFileNameInformation+VISTA+IRP_MJ_NETWORK_QUERY_OPEN+BSOD
来源:互联网 发布:json怎么解析 编辑:程序博客网 时间:2024/06/05 11:20
I'm assuming you're using a minifilter. The most interesting feature of this operation is that one of the parametersis an Irp. This is pretty much the only place in a minifilter where you willactually touch an IRP. That IRP is a fully initialized CREATE IRP and youcan use it for all your context needs (getting the PID and the user like youwould for any normal create). I don't remember about FltGetFileNameInformation, could be a bug or it couldbe something that simply doesn't make sense in this context. Regardless, I would suggest that you disallow this request (returnFLT_PREOP_DISALLOW_FASTIO in the preOp) and expect it will come on theregular create path, which is much easier to handle. As Rod pointed out,LUAFV (which is an inbox minifilter enabled by default on all Vista+ systemsas far as I remember) does it anyway so you're not gaining anything from aperformance perspective. And then there are other gotchas about thisoperation which IMO do not justify the extra effort.
- FltGetFileNameInformation+VISTA+IRP_MJ_NETWORK_QUERY_OPEN+BSOD
- FltGetFileNameInformation 函数
- BSOD Diagnostics
- BSOD及代码详解
- 【日常】漫谈bsod
- The OverClockers BSOD code list
- 调试笔记:BSOD 0xA
- 常见BSOD蓝屏原因分析
- 分析 : BSOD案例 2013-0821
- vista
- Vista
- VISTA
- 奇妙的BSOD:Bug Check 0xDA
- BSOD分析之空指针引用
- windbg分析BSOD dump文件实战
- Blue Screen Of Death ( BSOD ) 错误信息解析解释
- 搜素隐藏驱动的一个BSOD问题
- Ring3 User Token BSOD without Native API (Tested on SP3)
- poj 3051 Satellite Photographs 基础DFS
- Javascript调用后台方法
- 英特尔SR-IOV实现PCI硬件资源共享
- Ubuntu 11.10 上很棒的一组主题
- SQLServer 2005 Row_Number 的使用
- FltGetFileNameInformation+VISTA+IRP_MJ_NETWORK_QUERY_OPEN+BSOD
- UIKeyboard
- android Frame-By-Frame Animations(一帧一帧地播放动画)的使用
- iphone ios debug 调试时如何查看、监视变量
- timestamp(时间戳)详解
- libxml++
- [C#] DBNull、Null和String.Empty的区别
- 【开发者实用工具】移动应用信息统计
- plsql知识梳理-计划任务