-
-
[求助]minifilter中隐藏文件的问题
-
发表于: 2014-2-26 17:17 3629
-
我用minifilter做了一个隐藏文件的驱动,现在大部分都正常,但是当文件多了之后该隐藏的文件都隐藏掉了,但是该显示的文件部分没有显示,这是怎么回事呢,跪求大神指点 ,隐藏的代码如下
do
{
//DbgPrint("length is %d,filename is %S",currentFileInfo->FileNameLength,currentFileInfo->FileName);
// KdPrint(("FileName:%.*ws|| ShortName : %ws\n",currentFileInfo->FileNameLength/sizeof(WCHAR),currentFileInfo->FileName,currentFileInfo->ShortName));
//Byte offset of the next FILE_BOTH_DIR_INFORMATION entry
nextOffset = currentFileInfo->NextEntryOffset;
// KdPrint(("nextOffset:%d\n",nextOffset));
nextFileInfo = (PFILE_ID_BOTH_DIR_INFORMATION)((PCHAR)(currentFileInfo) + nextOffset);
if (currentFileInfo->FileAttributes == FILE_ATTRIBUTE_DIRECTORY)//判断要隐藏的是文件还是文件夹
{
FunctionPionter = ChkDir;
}
else
{
FunctionPionter = IsFileInUpLoadAnlyData;
}
//// 如果要隐藏的文件夹在FILE_BOTH_DIR_INFORMATION的第一个情况 需要特殊处理
if((previousFileInfo == currentFileInfo) &&
/*wcsstr(currentFileInfo->FileName,L".txt") != NULL */ !FunctionPionter(currentFileInfo->FileName,currentFileInfo->FileNameLength)&&
(currentFileInfo->FileNameLength> 0))
{
RtlCopyMemory(currentFileInfo->FileName,L".",2);
currentFileInfo->FileNameLength =2;
FltSetCallbackDataDirty( Data );
if(nextFileInfo == NULL)
{
previousFileInfo->NextEntryOffset = NULL;
Data->IoStatus.Status = STATUS_NO_SUCH_FILE;
}
else
{
//当前指针后移
currentFileInfo = nextFileInfo;
continue;
}
}
//若满足条件,隐藏之
if( !FunctionPionter(currentFileInfo->FileName,currentFileInfo->FileNameLength) && (currentFileInfo->FileNameLength>0))
{
if( nextOffset == 0 )
{
previousFileInfo->NextEntryOffset = 0;
}
else
{
previousFileInfo->NextEntryOffset +=currentFileInfo->NextEntryOffset;
}
modified = 1;
}
else
{
removedAllEntries = 0;
//前驱结点指针后移
previousFileInfo = currentFileInfo;
}
//当前指针后移
currentFileInfo = nextFileInfo;
} while( nextOffset != 0 );
KdPrint(("--------------1------1----------\n"));
if( modified )
{
/*if( removedAllEntries )
{
Data->IoStatus.Status = STATUS_NO_MORE_FILES;
}*/
/*else
{*/
FltSetCallbackDataDirty( Data );
/*}*/
}
do
{
//DbgPrint("length is %d,filename is %S",currentFileInfo->FileNameLength,currentFileInfo->FileName);
// KdPrint(("FileName:%.*ws|| ShortName : %ws\n",currentFileInfo->FileNameLength/sizeof(WCHAR),currentFileInfo->FileName,currentFileInfo->ShortName));
//Byte offset of the next FILE_BOTH_DIR_INFORMATION entry
nextOffset = currentFileInfo->NextEntryOffset;
// KdPrint(("nextOffset:%d\n",nextOffset));
nextFileInfo = (PFILE_ID_BOTH_DIR_INFORMATION)((PCHAR)(currentFileInfo) + nextOffset);
if (currentFileInfo->FileAttributes == FILE_ATTRIBUTE_DIRECTORY)//判断要隐藏的是文件还是文件夹
{
FunctionPionter = ChkDir;
}
else
{
FunctionPionter = IsFileInUpLoadAnlyData;
}
//// 如果要隐藏的文件夹在FILE_BOTH_DIR_INFORMATION的第一个情况 需要特殊处理
if((previousFileInfo == currentFileInfo) &&
/*wcsstr(currentFileInfo->FileName,L".txt") != NULL */ !FunctionPionter(currentFileInfo->FileName,currentFileInfo->FileNameLength)&&
(currentFileInfo->FileNameLength> 0))
{
RtlCopyMemory(currentFileInfo->FileName,L".",2);
currentFileInfo->FileNameLength =2;
FltSetCallbackDataDirty( Data );
if(nextFileInfo == NULL)
{
previousFileInfo->NextEntryOffset = NULL;
Data->IoStatus.Status = STATUS_NO_SUCH_FILE;
}
else
{
//当前指针后移
currentFileInfo = nextFileInfo;
continue;
}
}
//若满足条件,隐藏之
if( !FunctionPionter(currentFileInfo->FileName,currentFileInfo->FileNameLength) && (currentFileInfo->FileNameLength>0))
{
if( nextOffset == 0 )
{
previousFileInfo->NextEntryOffset = 0;
}
else
{
previousFileInfo->NextEntryOffset +=currentFileInfo->NextEntryOffset;
}
modified = 1;
}
else
{
removedAllEntries = 0;
//前驱结点指针后移
previousFileInfo = currentFileInfo;
}
//当前指针后移
currentFileInfo = nextFileInfo;
} while( nextOffset != 0 );
KdPrint(("--------------1------1----------\n"));
if( modified )
{
/*if( removedAllEntries )
{
Data->IoStatus.Status = STATUS_NO_MORE_FILES;
}*/
/*else
{*/
FltSetCallbackDataDirty( Data );
/*}*/
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
看原图
赞赏
雪币:
留言: