请求大佬赐教

在文件加密中，已经在IRP_MJ_QUERY_INFORMATION中设置中除加密标识外的文件长度

switch (IrpSp->Parameters.QueryFile.FileInformationClass)

{

//In all cases modify CurrentByteOffset and/or size (EndOfFile)

//to hide first InvisiblePartSize bytes

case FilePositionInformation:

((PFILE_POSITION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->CurrentByteOffset.QuadPart = 11,688;

break;

case FileEndOfFileInformation:

((PFILE_END_OF_FILE_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart = 11,688;

break;

case FileStandardInformation:

((PFILE_STANDARD_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart = 11,688;

break;

case FileAllocationInformation:

DbgPrint(("wang  IRP_MJ_QUERY_INFORMATION 3"));

((PFILE_ALLOCATION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->AllocationSize.QuadPart = 11,688;

break;

case FileAllInformation:

DbgPrint(("wang  IRP_MJ_QUERY_INFORMATION 4"));

((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->PositionInformation.CurrentByteOffset.QuadPart = 11,688;

((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->StandardInformation.EndOfFile.QuadPart = 11,688;

break;

}

但还是能文件资源浏览器还是能读取到加了标识符后的文件长度，请问这么做？

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课