Question

我目前正在尝试让我的内核过滤器与我的c＃应用程序进行通信。内核应用程序在我的结构中发送UNICODE_STRING，其中包含文件的路径。所有其他变量似乎都很好，缓冲区位置在用户和内核应用程序中看起来相同，但是当我调用我的ToString方法时，我得到了

usermodeFilter.MinifilterWrapper + NativeMethods + COMMAND_MESSAGE

我的c＃代码看起来像这样

    private NativeMethods.USERCOMMAND_MESSAGE data = new NativeMethods.USERCOMMAND_MESSAGE();

    [SecurityPermission(SecurityAction.Demand)]
    public void FilterGetMessage()
    {

        UInt32 result = NativeMethods.FilterGetMessage(_handle, ref data, (UInt32)Marshal.SizeOf(typeof(NativeMethods.USERCOMMAND_MESSAGE)), IntPtr.Zero);
        if (result == NativeMethods.S_OK)
        {
            Console.WriteLine("message recived");
            Console.WriteLine(this.getProcessNameFromId((int)this.data.cmdMessage.procesID));
            Console.WriteLine(this.data.cmdMessage.ToString());
        }
        else
        {
            throw new InvalidOperationException("Unknown error, number " +result);
        }

    }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        public struct COMMAND_MESSAGE { 
            public UInt32 procesID;
            public UNICODE_STRING fileName;
         } 

        [StructLayout(LayoutKind.Sequential)]
        public struct UNICODE_STRING : IDisposable
        {
            public ushort Length;
            public ushort MaximumLength;
            private IntPtr buffer;

            public UNICODE_STRING(string s)
            {
                Length = (ushort)(s.Length * 2);
                MaximumLength = (ushort)(Length + 2);
                buffer = Marshal.StringToHGlobalUni(s);
            }

            public void Dispose()
            {
                Marshal.FreeHGlobal(buffer);
                buffer = IntPtr.Zero;
            }

            public override string ToString()
            {
                return Marshal.PtrToStringUni(buffer);
            }
          }

C ++部分代码看起来

            WCHAR parametersKeyBuffer[255];
            gCmdMessageSend.name.Buffer = parametersKeyBuffer;
            gCmdMessageSend.name.MaximumLength = sizeof(parametersKeyBuffer);
            gCmdMessageSend.name.Length = 0;
            RtlCopyUnicodeString(&gCmdMessageSend.name, &fileInfo->Name);
            if (FsClientPort)
                {
                    ulReplayLength = sizeof(gCmdMessageSend);
                    status = FltSendMessage(gFilterHandle, &FsClientPort, &gCmdMessageSend, sizeof(gCmdMessageSend), NULL, &ulReplayLength, &timeout);
                }

顺便说一下，我也获得了对内存位置的无效访问权限。 Marshal.FreeHGlobal（缓冲区）时出错;所以我猜我做错了什么

Answer 1

Console.WriteLine（this.data.cmdMessage.ToString（））;

您没有覆盖ToString()方法，因此默认为类型名称。您还需要覆盖此类中的ToString()方法（COMMAND_MESSAGE）。

Marshal.PtrToStringUni（s）返回类名而不是消息

1 个答案: