[求助]微过滤的PreCallback 和 PosCallback 处理I/O操作的顺序是否一样？-软件逆向-看雪-安全社区|安全招聘|kanxue.com

最新回复 (1)
DriverAsm 雪币： 22 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 11 回帖 146 粉丝 0 关注私信	DriverAsm 2 楼好吧、这个问题本身问得非常弱智～～～啥都不说了。 http://msdn.microsoft.com/en-us/library/windows/hardware/ff551109(v=vs.85).aspx CompletionContext [out] If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to be passed to the corresponding post-operation callback routine. Otherwise, it must be NULL. http://msdn.microsoft.com/en-us/library/windows/hardware/ff551107(v=vs.85).aspx CompletionContext [in, optional] A context pointer that was returned by the minifilter driver's pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine. The CompletionContext pointer provides a way to communicate information from the pre-operation callback routine to the post-operation callback routine. 然后再参考一下 WDK7 sample minispy 对该参数的操作就能明白了～ 2013-6-18 16:27 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

最新回复 (1)

DriverAsm

雪币： 22

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

回帖

146

粉丝

关注

私信

DriverAsm: 2 楼

好吧、这个问题本身问得非常弱智～～～

啥都不说了。

http://msdn.microsoft.com/en-us/library/windows/hardware/ff551109(v=vs.85).aspx

CompletionContext [out]
If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to be passed to the corresponding post-operation callback routine. Otherwise, it must be NULL.

http://msdn.microsoft.com/en-us/library/windows/hardware/ff551107(v=vs.85).aspx

CompletionContext [in, optional]
A context pointer that was returned by the minifilter driver's pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine. The CompletionContext pointer provides a way to communicate information from the pre-operation callback routine to the post-operation callback routine.

然后再参考一下 WDK7 sample minispy 对该参数的操作就能明白了～

2013-6-18 16:27