FLT_POSTOP_CALLBACK_STATUS TestPostCreate(
  __inout PFLT_CALLBACK_DATA Data,
  __in PCFLT_RELATED_OBJECTS FltObjects,
  __in_opt PVOID CompletionContext,
  __in FLT_POST_OPERATION_FLAGS Flags
  )
{
  NTSTATUS status;
  PFLT_FILE_NAME_INFORMATION NameInfo;
  UNICODE_STRING Extension;
  UNICODE_STRING FileName,VolumeName;

  ANSI_STRING AnsiPath;

  PAGED_CODE();

  
  RtlInitUnicodeString(&Extension,L"txt");

  status = FltGetFileNameInformation(Data,FLT_FILE_NAME_NORMALIZED|FLT_FILE_NAME_QUERY_DEFAULT,&NameInfo);
  if (!NT_SUCCESS(Data->IoStatus.Status))
  {
    FltParseFileNameInformation(NameInfo);
    return FLT_POSTOP_FINISHED_PROCESSING;
  }

  
  
  
  if (NameInfo->Extension.Length!=0)
  {
    if (RtlEqualUnicodeString(&NameInfo->Extension,&Extension,FALSE))
    {
      IoVolumeDeviceToDosName(FltObjects->FileObject->DeviceObject,&VolumeName);

      FileName.Buffer = (PWCH) ExAllocatePool(NonPagedPool,512);
      FileName.Length = 0;
      FileName.MaximumLength = 512;
      RtlZeroMemory(FileName.Buffer,512);
      
      RtlAppendUnicodeStringToString(&FileName,&VolumeName);

      
      ExFreePool(VolumeName.Buffer);

      RtlAppendUnicodeStringToString(&FileName,&FltObjects->FileObject->FileName);
      AnsiPath.Buffer = (CHAR*)ExAllocatePool(NonPagedPool,512);
      AnsiPath.Length =0 ;
      AnsiPath.MaximumLength = 512;
      RtlUnicodeStringToAnsiString(&AnsiPath,&FileName,FALSE);
      //TestSendMessage(AnsiPath.Buffer,AnsiPath.Length);
      ExFreePool(FileName.Buffer);
      ExFreePool(AnsiPath.Buffer);
    }
  }

  FltReleaseFileNameInformation(NameInfo);

  //KdPrint((NameInfo->Extension.Buffer));
  return FLT_POSTOP_FINISHED_PROCESSING;

}

这段代码可以运行，但是不久就会蓝屏，蓝屏就在这个函数里
请教下是什么问题呢

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！