📄 irpnames.c
字号:
/*++
Copyright (c) 1989-1999 Microsoft Corporation
Module Name:
irpName.c
Abstract:
This module contains functions used to generate names for IRPs
Environment:
User mode
--*/
#include <ntifs.h>
#include <stdio.h>
#include "filespyLib.h"
//
// Globals
//
CHAR UnknownIrpMinor[] = "Unknown Irp minor code (%u)";
VOID
GetIrpName (
IN UCHAR MajorCode,
IN UCHAR MinorCode,
IN ULONG FsctlCode,
OUT PCHAR MajorCodeName,
OUT PCHAR MinorCodeName
)
/*++
Routine Description:
This routine translates the given Irp codes into printable strings which
are returned. This guarantees to routine valid strings in each buffer.
The MinorCode string may be a NULL string (not a null pointer).
Arguments:
MajorCode - the IRP Major code of the operation
MinorCode - the IRP Minor code of the operation
FsctlCode - if this is an IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST
operation then this is the FSCTL code whose name is also
translated. This name is returned as part of the MinorCode
string.
MajorCodeName - a string buffer at least OPERATION_NAME_BUFFER_SIZE
characters long that receives the major code name.
MinorCodeName - a string buffer at least OPERATION_NAME_BUFFER_SIZE
characters long that receives the minor/fsctl code name.
Return Value:
None.
--*/
{
PCHAR irpMajorString;
PCHAR irpMinorString = "";
CHAR nameBuf[OPERATION_NAME_BUFFER_SIZE];
switch (MajorCode) {
case IRP_MJ_CREATE:
irpMajorString = "IRP_MJ_CREATE";
break;
case IRP_MJ_CREATE_NAMED_PIPE:
irpMajorString = "IRP_MJ_CREATE_NAMED_PIPE";
break;
case IRP_MJ_CLOSE:
irpMajorString = "IRP_MJ_CLOSE";
break;
case IRP_MJ_READ:
irpMajorString = "IRP_MJ_READ";
switch (MinorCode) {
case IRP_MN_NORMAL:
irpMinorString = "IRP_MN_NORMAL";
break;
case IRP_MN_DPC:
irpMinorString = "IRP_MN_DPC";
break;
case IRP_MN_MDL:
irpMinorString = "IRP_MN_MDL";
break;
case IRP_MN_COMPLETE:
irpMinorString = "IRP_MN_COMPLETE";
break;
case IRP_MN_COMPRESSED:
irpMinorString = "IRP_MN_COMPRESSED";
break;
case IRP_MN_MDL_DPC:
irpMinorString = "IRP_MN_MDL_DPC";
break;
case IRP_MN_COMPLETE_MDL:
irpMinorString = "IRP_MN_COMPLETE_MDL";
break;
case IRP_MN_COMPLETE_MDL_DPC:
irpMinorString = "IRP_MN_COMPLETE_MDL_DPC";
break;
default:
sprintf( nameBuf, UnknownIrpMinor, MinorCode );
irpMinorString = nameBuf;
}
break;
case IRP_MJ_WRITE:
irpMajorString = "IRP_MJ_WRITE";
switch (MinorCode) {
case IRP_MN_NORMAL:
irpMinorString = "IRP_MN_NORMAL";
break;
case IRP_MN_DPC:
irpMinorString = "IRP_MN_DPC";
break;
case IRP_MN_MDL:
irpMinorString = "IRP_MN_MDL";
break;
case IRP_MN_COMPLETE:
irpMinorString = "IRP_MN_COMPLETE";
break;
case IRP_MN_COMPRESSED:
irpMinorString = "IRP_MN_COMPRESSED";
break;
case IRP_MN_MDL_DPC:
irpMinorString = "IRP_MN_MDL_DPC";
break;
case IRP_MN_COMPLETE_MDL:
irpMinorString = "IRP_MN_COMPLETE_MDL";
break;
case IRP_MN_COMPLETE_MDL_DPC:
irpMinorString = "IRP_MN_COMPLETE_MDL_DPC";
break;
default:
sprintf( nameBuf,UnknownIrpMinor,MinorCode );
irpMinorString = nameBuf;
}
break;
case IRP_MJ_QUERY_INFORMATION:
irpMajorString = "IRP_MJ_QUERY_INFORMATION";
break;
case IRP_MJ_SET_INFORMATION:
irpMajorString = "IRP_MJ_SET_INFORMATION";
break;
case IRP_MJ_QUERY_EA:
irpMajorString = "IRP_MJ_QUERY_EA";
break;
case IRP_MJ_SET_EA:
irpMajorString = "IRP_MJ_SET_EA";
break;
case IRP_MJ_FLUSH_BUFFERS:
irpMajorString = "IRP_MJ_FLUSH_BUFFERS";
break;
case IRP_MJ_QUERY_VOLUME_INFORMATION:
irpMajorString = "IRP_MJ_QUERY_VOLUME_INFORMATION";
break;
case IRP_MJ_SET_VOLUME_INFORMATION:
irpMajorString = "IRP_MJ_SET_VOLUME_INFORMATION";
break;
case IRP_MJ_DIRECTORY_CONTROL:
irpMajorString = "IRP_MJ_DIRECTORY_CONTROL";
switch (MinorCode) {
case IRP_MN_QUERY_DIRECTORY:
irpMinorString = "IRP_MN_QUERY_DIRECTORY";
break;
case IRP_MN_NOTIFY_CHANGE_DIRECTORY:
irpMinorString = "IRP_MN_NOTIFY_CHANGE_DIRECTORY";
break;
default:
sprintf( nameBuf,UnknownIrpMinor,MinorCode );
irpMinorString = nameBuf;
}
break;
case IRP_MJ_FILE_SYSTEM_CONTROL:
irpMajorString = "IRP_MJ_FILE_SYSTEM_CONTROL";
switch (MinorCode) {
case IRP_MN_USER_FS_REQUEST:
switch (FsctlCode) {
case FSCTL_REQUEST_OPLOCK_LEVEL_1:
irpMinorString = "FSCTL_REQUEST_OPLOCK_LEVEL_1";
break;
case FSCTL_REQUEST_OPLOCK_LEVEL_2:
irpMinorString = "FSCTL_REQUEST_OPLOCK_LEVEL_2";
break;
case FSCTL_REQUEST_BATCH_OPLOCK:
irpMinorString = "FSCTL_REQUEST_BATCH_OPLOCK";
break;
case FSCTL_OPLOCK_BREAK_ACKNOWLEDGE:
irpMinorString = "FSCTL_OPLOCK_BREAK_ACKNOWLEDGE";
break;
case FSCTL_OPBATCH_ACK_CLOSE_PENDING:
irpMinorString = "FSCTL_OPBATCH_ACK_CLOSE_PENDING";
break;
case FSCTL_OPLOCK_BREAK_NOTIFY:
irpMinorString = "FSCTL_OPLOCK_BREAK_NOTIFY";
break;
case FSCTL_LOCK_VOLUME:
irpMinorString = "FSCTL_LOCK_VOLUME";
break;
case FSCTL_UNLOCK_VOLUME:
irpMinorString = "FSCTL_UNLOCK_VOLUME";
break;
case FSCTL_DISMOUNT_VOLUME:
irpMinorString = "FSCTL_DISMOUNT_VOLUME";
break;
case FSCTL_IS_VOLUME_MOUNTED:
irpMinorString = "FSCTL_IS_VOLUME_MOUNTED";
break;
case FSCTL_IS_PATHNAME_VALID:
irpMinorString = "FSCTL_IS_PATHNAME_VALID";
break;
case FSCTL_MARK_VOLUME_DIRTY:
irpMinorString = "FSCTL_MARK_VOLUME_DIRTY";
break;
case FSCTL_QUERY_RETRIEVAL_POINTERS:
irpMinorString = "FSCTL_QUERY_RETRIEVAL_POINTERS";
break;
case FSCTL_GET_COMPRESSION:
irpMinorString = "FSCTL_GET_COMPRESSION";
break;
case FSCTL_SET_COMPRESSION:
irpMinorString = "FSCTL_SET_COMPRESSION";
break;
case FSCTL_MARK_AS_SYSTEM_HIVE:
irpMinorString = "FSCTL_MARK_AS_SYSTEM_HIVE";
break;
case FSCTL_OPLOCK_BREAK_ACK_NO_2:
irpMinorString = "FSCTL_OPLOCK_BREAK_ACK_NO_2";
break;
case FSCTL_INVALIDATE_VOLUMES:
irpMinorString = "FSCTL_INVALIDATE_VOLUMES";
break;
case FSCTL_QUERY_FAT_BPB:
irpMinorString = "FSCTL_QUERY_FAT_BPB";
break;
case FSCTL_REQUEST_FILTER_OPLOCK:
irpMinorString = "FSCTL_REQUEST_FILTER_OPLOCK";
break;
case FSCTL_FILESYSTEM_GET_STATISTICS:
irpMinorString = "FSCTL_FILESYSTEM_GET_STATISTICS";
break;
case FSCTL_GET_NTFS_VOLUME_DATA:
irpMinorString = "FSCTL_GET_NTFS_VOLUME_DATA";
break;
case FSCTL_GET_NTFS_FILE_RECORD:
irpMinorString = "FSCTL_GET_NTFS_FILE_RECORD";
break;
case FSCTL_GET_VOLUME_BITMAP:
irpMinorString = "FSCTL_GET_VOLUME_BITMAP";
break;
case FSCTL_GET_RETRIEVAL_POINTERS:
irpMinorString = "FSCTL_GET_RETRIEVAL_POINTERS";
break;
case FSCTL_MOVE_FILE:
irpMinorString = "FSCTL_MOVE_FILE";
break;
case FSCTL_IS_VOLUME_DIRTY:
irpMinorString = "FSCTL_IS_VOLUME_DIRTY";
break;
case FSCTL_ALLOW_EXTENDED_DASD_IO:
irpMinorString = "FSCTL_ALLOW_EXTENDED_DASD_IO";
break;
case FSCTL_FIND_FILES_BY_SID:
irpMinorString = "FSCTL_FIND_FILES_BY_SID";
break;
case FSCTL_SET_OBJECT_ID:
irpMinorString = "FSCTL_SET_OBJECT_ID";
break;
case FSCTL_GET_OBJECT_ID:
irpMinorString = "FSCTL_GET_OBJECT_ID";
break;
case FSCTL_DELETE_OBJECT_ID:
irpMinorString = "FSCTL_DELETE_OBJECT_ID";
break;
case FSCTL_SET_REPARSE_POINT:
irpMinorString = "FSCTL_SET_REPARSE_POINT";
break;
case FSCTL_GET_REPARSE_POINT:
irpMinorString = "FSCTL_GET_REPARSE_POINT";
break;
case FSCTL_DELETE_REPARSE_POINT:
irpMinorString = "FSCTL_DELETE_REPARSE_POINT";
break;
case FSCTL_ENUM_USN_DATA:
irpMinorString = "FSCTL_ENUM_USN_DATA";
break;
case FSCTL_SECURITY_ID_CHECK:
irpMinorString = "FSCTL_SECURITY_ID_CHECK";
break;
case FSCTL_READ_USN_JOURNAL:
irpMinorString = "FSCTL_READ_USN_JOURNAL";
break;
case FSCTL_SET_OBJECT_ID_EXTENDED:
irpMinorString = "FSCTL_SET_OBJECT_ID_EXTENDED";
break;
case FSCTL_CREATE_OR_GET_OBJECT_ID:
irpMinorString = "FSCTL_CREATE_OR_GET_OBJECT_ID";
break;
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -