我正在编写一个windows filesystem minifilter driver I/O Request Packets (IRP's),preoperation callback根据其类型(读/写)在Here中失败。
我如何从回调参数(或其他地方?)中找出操作是 read-like (仅读取数据)还是类似于写入(修改数据)磁盘 - 写,删除,格式等)?
{{3}}是主要IRP代码列表。
我正在考虑这样的事情:
Data->Iopb->TargetFileObject->ReadAccess
Data->Iopb->TargetFileObject->WriteAccess
但我不确定,我认为这些仅在后期操作回调中可用。文档非常麻烦。
代码示例以进一步说明:
FLT_PREOP_CALLBACK_STATUS
Fail (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
FLT_PREOP_CALLBACK_STATUS status = FLT_PREOP_SUCCESS_NO_CALLBACK;
//********************************************************************
if ( IS_WRITE_LIKE(Data, FltObjects) ) { // ??? HOW DO I FIND OUT ???
//********************************************************************
if( FLT_IS_FASTIO_OPERATION(Data) ){
status = FLT_PREOP_DISALLOW_FASTIO;
} else {
status = FLT_PREOP_COMPLETE;
}
Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
return status;
}
return status;
}
答案 0 :(得分:0)
以下是经过大量试验和错误后获得的欧洲清单:
像写一样:IRP_MJ_SET_EA
IRP_MJ_SET_INFORMATION
IRP_MJ_SET_QUOTA
IRP_MJ_SET_SECURITY
IRP_MJ_SET_VOLUME_INFORMATION
IRP_MJ_WRITE
读样:
IRP_MJ_CREATE
IRP_MJ_DEVICE_CONTROL
IRP_MJ_FILE_SYSTEM_CONTROL
IRP_MJ_FLUSH_BUFFERS
IRP_MJ_INTERNAL_DEVICE_CONTROL
IRP_MJ_QUERY_EA
IRP_MJ_QUERY_INFORMATION
IRP_MJ_QUERY_QUOTA
IRP_MJ_QUERY_SECURITY
IRP_MJ_QUERY_VOLUME_INFORMATION
IRP_MJ_READ
IRP_MJ_OPERATION_END