FLT_PREOP_CALLBACK_STATUS PfltPreOperationCallbackCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID *CompletionContext) { PFILE_ID_BOTH_DIR_INFORMATION pSafeBuffer = Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer; PWCHAR szFileName = (PWCHAR)ExAllocatePool(NonPagedPool, pSafeBuffer->FileNameLength); DbgBreakPoint(); RtlCopyMemory(szFileName, pSafeBuffer->FileName, pSafeBuffer->FileNameLength); if (wcsstr(szFileName,L"AAAA.pak")) { ExFreePool(szFileName); return STATUS_ACCESS_DENIED; } ExFreePool(szFileName); return FLT_PREOP_SUCCESS_NO_CALLBACK; }
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
syser +1 楼主这个ExAllocatePool 多申请个sizeof(WCHAR) 你这是准备加入吃鸡豪华套餐吧 @腾讯 你要关注下了
syser
