//----------------------------------------------------------------------
//
// FileMonQueryFile
//
// This function retrieves the “standard” information for the
// underlying file system, asking for the filename in particular.
//
//----------------------------------------------------------------------
BOOLEAN
FileMonQueryFile(
PDEVICE_OBJECT DeviceObject,
PFILE_OBJECT FileObject,
FILE_INFORMATION_CLASS FileInformationClass,
PVOID FileQueryBuffer,
ULONG FileQueryBufferLength
)
{
PIRP irp;
KEVENT event;
IO_STATUS_BLOCK IoStatusBlock;
PIO_STACK_LOCATION ioStackLocation;
DbgPrint((“Getting file name for %x\n”, FileObject));
//
// Initialize the event
//
KeInitializeEvent(&event, SynchronizationEvent, FALSE);
//
// Allocate an irp for this request. This could also come from a
// private pool, for instance.
//
irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
if(!irp) {
//
// Failure!
//
return FALSE;
}
//
// Build the IRP’s main body
//
irp->AssociatedIrp.SystemBuffer = FileQueryBuffer;
irp->UserEvent = &event;
irp->UserIosb = &IoStatusBlock;
irp->Tail.Overlay.Thread = PsGetCurrentThread();
irp->Tail.Overlay.OriginalFileObject = FileObject;
irp->RequestorMode = KernelMode;
irp->Flags = 0;
irp->Flags = irp->Flags |
(IRP_NOCACHE|IRP_PAGING_IO|IRP_SYNCHRONOUS_PAGING_IO )|IRP_BUFFERED_IO;//
//
//
// Set up the I/O stack location.
//
ioStackLocation = IoGetNextIrpStackLocation(irp);
ioStackLocation->MajorFunction = IRP_MJ_QUERY_INFORMATION;
ioStackLocation->DeviceObject = DeviceObject;
ioStackLocation->FileObject = FileObject;
ioStackLocation->Parameters.QueryFile.Length = FileQueryBufferLength;
ioStackLocation->Parameters.QueryFile.FileInformationClass =
FileInformationClass;
//
// Set the completion routine.
//
IoSetCompletionRoutine(irp, FileMonQueryFileComplete, 0, TRUE, TRUE,
TRUE);
//
// Send it to the FSD
//
do{
NTSTATUS _stat=0;
DbgPrint((" Before IoCallDriver for QueryFile Infor \n"));
_stat=IoCallDriver(DeviceObject, irp);
DbgPrint((" End IoCallDriver for QueryFile Infor \n"));
//
// Wait for the I/O
//
if(STATUS_PENDING==_stat)
{
KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);
}else{
IoStatusBlock.Status=_stat;
}
}while(0);
//
// Done! Note that since our completion routine frees the IRP we cannot
// touch the IRP now.
//
return NT_SUCCESS( IoStatusBlock.Status );
}
ÔÚÄúµÄÀ´ÐÅÖÐÌáµ½
hello ,everyone!
I built a filter driver like filemon on a ntfs system.
And make a new IRP_MJ_QUERYINFOMATION irp when filter device received a
IRP_MJ_WRITE IRP.When I sent IRP_MJ_QUERYINFOMATION before passthru
IRP_MJ_WRITE IRP ,enter a deadlock in IoCallDriver.
why?
fang–http://www.eyou.com
–Îȶ¨¿É¿¿µÄµç×ÓÐÅÏä ÓïÒôÓʼþ ÒÆ¶¯ÊéÇ© ÈÕÀú·þÎñ ÍøÂç´æ´¢…ÒÚÓÊδ¾¡–http://vip.eyou.com
–¿ì¿ìµÇ¼ÒÚÓÊVIPÐÅÏä ×¢²áÄúÖÐÒâµÄÓû§Ãû
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17You are currently subscribed to ntfsd as: xxxxx@eyou.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–http://www.eyou.com
–Îȶ¨¿É¿¿µÄµç×ÓÐÅÏä ÓïÒôÓʼþ ÒÆ¶¯ÊéÇ© ÈÕÀú·þÎñ ÍøÂç´æ´¢…ÒÚÓÊδ¾¡
–http://vip.eyou.com
–¿ì¿ìµÇ¼ÒÚÓÊVIPÐÅÏä ×¢²áÄúÖÐÒâµÄÓû§Ãû