为了后来者不再晕，总结如下:
转载
1.加密在SfWrite(IRP_MJ_WRITE)中，而不是完成例程，
解密在SfRead(IRP_MJ_READ)中，而不是完成例程，
3.只要处理IRP_NOCACHE|IRP_PAGING_IO|IRP_SYNCHRONOUS_PAGING_IO
2.加密简单过程:
a.得到Windows传下来的Buffer Address,
if (Irp->MdlAddress)
{
SysDataBuf = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
}
else
{
SysDataBuf = Irp->UserBuffer;
}
b.保存明文SysDataBuf 在SysDataBufFirst
c.用你强大的算法加密SysDataBuf –>> MyBuf
d.把MyBuf Copy到 SysDataBuf，
e.IoCallDriver 把密文向下传，写入HardDisk。
f.恢复内存的明文 RtlCopyMemory(SysDataBuf,SysDataBufFirst, ulWriteLen);.
3.解密的大致过程:
a.IoCallDriver 读到密文
b，解密
c。IoCompleteRequest 搞定
我的开发环境:
IFS2600,SFilter的代码却是for XP SP1的
再仍一块砖头：
如何从IrpStackLocation中判断来自网络的文件访问？
//—————————————————
NTSTATUS status;
PACCESS_TOKEN pToken = NULL;
PTOKEN_SOURCE pTokenSrc = NULL ;
PSECURITY_SUBJECT_CONTEXT secSubCtx;
secSubCtx = &(IrpSp->Parameters.create.SecurityContext->AccessState->SubjectSecurityContext);
if (secSubCtx->ClientToken != NULL || secSubCtx->PrimaryToken != NULL)
{
pToken = SeQuerySubjectContextToken(secSubCtx);
}
if (pToken == NULL)
{
//KdPrint((“SeQuerySubjectContextToken Errorn”));
return 0
}
//
// Get TokenSource Name If SourceName is “NtLmSsp” it was logged-in via Lanmanager,
// “User32″ represents localy logged-in users.
//
__try
{
status = SeQueryInformationToken(pToken,TokenSource,&pTokenSrc);
if (NT_SUCCESS(status))
{
pTokenSrc->SourceName[TOKEN_SOURCE_LENGTH-1] = 0×00;
KdPrint((“Token Name :%s Len:%dn”,pTokenSrc->SourceName,strlen(pTokenSrc->SourceName)));
if (_stricmp(pTokenSrc->SourceName,”NtLmSsp”) == 0 )
{
KdPrint((“NetWork Access Token Findn”));
return 123
}
}
else
{
KdPrint((“SeQueryInformationToken Error:0x%xn”,status));
}
}
__finally
{
ExFreePool(pTokenSrc);
}
return 0
0 评论.