Visual Studio 2013开发 mini-filter driver step by step (5) - 读写文件
来源:互联网 发布:交通事故原因数据统计 编辑:程序博客网 时间:2024/05/16 00:33
在kernel中读写文件要比在应用层麻烦一些,但是基本思路大体上还是一致的。
在内核中,也有很多相关的读写文件的API,本文只对
FltCreateFileEx
FltReadFile
FltWriteFile
进行简单说明。
这三个API和应用层的API CreateFileEx,ReadFile和WriteFile相对应。其作用分别是打开文件,从文件中读取数据和将数据写入文件。下面这个函数实现了文件拷贝操作,即将FullFileName的文件内容拷贝到FullFileName2中。
NTSTATUS ReadFileTest(INPUNICODE_STRINGFullFileName,INPUNICODE_STRINGFullFileName2)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
PVOID buffer = NULL;
ULONG total_len = 0;
ULONG readbytes = 0;
ULONG byteswritten = 0;
HANDLE FileHandle = NULL;
PFILE_OBJECT FileObject = NULL;
HANDLE FileHandle2 = NULL;
PFILE_OBJECT FileObject2 = NULL;
OBJECT_ATTRIBUTES ObjectAttributes;
OBJECT_ATTRIBUTES ObjectAttributes2;
IO_STATUS_BLOCK IoStatus;
PFLT_VOLUME Volume = NULL;
PFLT_INSTANCE Instance = NULL;
buffer = ExAllocatePoolWithTag(PagedPool, 4096,'ssmf');
InitializeObjectAttributes(
&ObjectAttributes,
FullFileName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
InitializeObjectAttributes(
&ObjectAttributes2,
FullFileName2,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
status = FltCreateFileEx(
gFilterHandle,
NULL,
&FileHandle,
&FileObject,
GENERIC_READ,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT | FILE_SEQUENTIAL_ONLY | FILE_COMPLETE_IF_OPLOCKED,
NULL,
0,
IO_NO_PARAMETER_CHECKING
);
status = FltCreateFileEx(
gFilterHandle,
NULL,
&FileHandle2,
&FileObject2,
GENERIC_READ|GENERIC_WRITE,
&ObjectAttributes2,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OVERWRITE_IF,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT | FILE_SEQUENTIAL_ONLY | FILE_COMPLETE_IF_OPLOCKED,
NULL,
0,
IO_NO_PARAMETER_CHECKING
);
PT_DBG_PRINT(PTDBG_TRACE_ROUTINES, ("SSMF:Open the file status is status=%08x\n",status));
if (FileObject)
{
//read the file
//get the volume
status = FltGetVolumeFromFileObject(gFilterHandle, FileObject, &Volume);
if (NT_SUCCESS(status))
{
status = FltGetVolumeInstanceFromName(
gFilterHandle,
Volume,
NULL,
&Instance
);
if (NT_SUCCESS(status))
{
while (STATUS_END_OF_FILE != FltReadFile(Instance, FileObject, NULL, 4096,
buffer,FLTFL_IO_OPERATION_NON_CACHED, &readbytes, NULL,NULL))
{
total_len += readbytes;
PT_DBG_PRINT(PTDBG_TRACE_ROUTINES, ("SSMF:Read length is %u,total len is %u\n", readbytes, total_len));
FltWriteFile(Instance, FileObject2,NULL, readbytes, buffer, FLTFL_IO_OPERATION_NON_CACHED, &byteswritten, NULL,NULL);
}
}
if (Volume)
{
FltObjectDereference(Volume);
}
if (Instance)
{
FltObjectDereference(Instance);
}
}
}
if (FileObject)
{
FltClose(FileHandle);
ObDereferenceObject(FileObject);
}
if (FileObject2)
{
FltClose(FileHandle2);
ObDereferenceObject(FileObject2);
}
if (buffer != NULL)
{
ExFreePoolWithTag(buffer,'ssmf');
}
return status;
}
写这段代码的时候发生了一个小插曲,当我准备用sc stop ssmf来停止ssmf的时候,居然hung住了,我想肯定是我的代码有问题,果断按下ctrl+scroll键两次,让系统蓝屏,产生dump文件。
最后分析dump文件,果然是ssmf不能退出,如下图所示。
原因是在某种情况下没有打开FullfileName1,但是打开了FullfileName2,但是FileObject没有关闭,导致driver在unload的时候要等所有的run-down对象的引用计数都为0,但是针对FileObject2,没有调用
ObDereferenceObject(FileObject2);
则使系统调用ExfWaitForRundownProtectionRelease一直等待下去。
- Visual Studio 2013开发 mini-filter driver step by step (5) - 读写文件
- Visual Studio 2013开发 mini-filter driver step by step 获取文件读写内容(6)
- Visual Studio 2013开发 mini-filter driver step by step (1) - 创建 mini filter driver 工程
- Visual Studio 2013开发 mini-filter driver step by step (11) driver 签名
- Visual Studio 2013开发 mini-filter driver step by step (2) - 编译,部署,运行
- Visual Studio 2013开发 mini-filter driver step by step (3) - 查看运行结果
- Visual Studio 2013开发 mini-filter driver step by step (4) - 获取文件名
- Visual Studio 2013开发 mini-filter driver step by step 内核中使用线程(7)
- Visual Studio 2013开发 mini-filter driver step by step 应用层与内核通讯(8)
- Visual Studio 2013开发 mini-filter driver step by step 内核代码段分页alloc_text的使用(9)
- Visual Studio 2013开发 mini-filter driver step by step 获取可执行文件名称 - 实现process monitor的一个功能 (10)
- File System Mini Filter Driver Step by Step
- Introduction to Microsoft Visual Studio(for beginners)step by step
- Visual Studio 2010 step by step学习摘要
- Step By Step Mini Site Video Training
- iPhone开发step by step
- RMI开发 Step By Step
- Microsoft Visual C# 2005 Step by Step
- 异常处理系列: WARNING: Data partition already in use. Changes will not persist!
- 移动端web轮播图
- UVA - 11210 Chinese Mahjong(回溯)
- hdu 4064 Carcassonne(DP-插头DP)
- 内核栈和用户栈的区别
- Visual Studio 2013开发 mini-filter driver step by step (5) - 读写文件
- 《STK基础教程》首发
- 编译错误之丢失Microsoft Excel 14.0 Object Library
- git.multi-gc下auto选项支持
- 黑马程序员18——OC之Fundation(NSSet)
- Linux下安装JDK
- pyQt 每日一练习 -- 登录框
- 天猫大数据3—回归模型
- 【编程珠玑】第四章:编写正确的程序