在IRP_MJ_CREATE中实现了对U盘的禁止访问!
但是发现在弹出U盘的时候总是提示U盘正在使用!
由于网络问题上不了图,贴出precreate的代码:
FLT_PREOP_CALLBACK_STATUS
FsFilter3PreCreate(
_Inout_ PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
/*++
Routine Description:
This routine is a pre-operation dispatch routine for this miniFilter.
This is non-pageable because it could be called on the paging path
Arguments:
Data - Pointer to the filter callbackData that is passed to us.
FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
opaque handles to this filter, instance, its associated volume and
file object.
CompletionContext - The context for the completion routine for this
operation.
Return Value:
The return value is the status of the operation.
--*/
{
NTSTATUS status;
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(CompletionContext);
//PFLT_FILE_NAME_INFORMATION pinfo;
//BOOLEAN bMatchFound;
PFsFilter3_INSTANCE_CONTEXT pAIC = NULL;
BOOLEAN ucFlags=FALSE;
PAGED_CODE();
status = FltGetInstanceContext(Data->Iopb->TargetInstance, &pAIC);
if (!NT_SUCCESS(status))
return FLT_PREOP_SUCCESS_NO_CALLBACK;
//true代表是USB设备
ucFlags = pAIC->ucFlags;
if (pAIC != NULL)
FltReleaseContext(pAIC);
ULONG CreatePosition;
ULONG Position;
Position = Data->Iopb->Parameters.Create.Options;
CreatePosition = (Data->Iopb->Parameters.Create.Options >> 24) & 0xFF;
//拒绝USB操作
if (ucFlags && (CreatePosition == FILE_OPEN))
{
//拒绝文件操作
DbgPrint("pasthrough pre Create: access denied");
DbgPrint("%s", ucFlags == FALSE ? "FALSE" : "TRUE");
Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;
}
else
{
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
}
跪求大神提示下可能哪里出了问题!
4 个解决方案
#2
up 实在是小白,看了一些资料也没能解决。。
#3
这个网站上难道没有问答论坛吗?
#4
FltReleaseContext();检查一下打开的设备是否关闭了
#1
Windows驱动开发
http://www.osronline.com/
#2
up 实在是小白,看了一些资料也没能解决。。
#3
这个网站上难道没有问答论坛吗?
#4
FltReleaseContext();检查一下打开的设备是否关闭了