fspylog.c

文件过滤驱动

            irpMinorString = IRP_MN_LOCK_STRING;
            break;
        case IRP_MN_UNLOCK_SINGLE: 
            irpMinorString = IRP_MN_UNLOCK_SINGLE_STRING;
            break;
        case IRP_MN_UNLOCK_ALL: 
            irpMinorString = IRP_MN_UNLOCK_ALL_STRING;
            break;
        case IRP_MN_UNLOCK_ALL_BY_KEY: 
            irpMinorString = IRP_MN_UNLOCK_ALL_BY_KEY_STRING;
            break;
        default:
            sprintf(errorBuf,"Unknown Irp minor code (%u)",MinorCode);
            irpMinorString = errorBuf;
        }
        break;

    case IRP_MJ_CLEANUP:
        irpMajorString = IRP_MJ_CLEANUP_STRING;
        break;
    case IRP_MJ_CREATE_MAILSLOT:
        irpMajorString = IRP_MJ_CREATE_MAILSLOT_STRING;
        break;
    case IRP_MJ_QUERY_SECURITY:
        irpMajorString = IRP_MJ_QUERY_SECURITY_STRING;
        break;
    case IRP_MJ_SET_SECURITY:
        irpMajorString = IRP_MJ_SET_SECURITY_STRING;
        break;
    case IRP_MJ_POWER:
        irpMajorString = IRP_MJ_POWER_STRING;
        switch (MinorCode) {
        case IRP_MN_WAIT_WAKE: 
            irpMinorString = IRP_MN_WAIT_WAKE_STRING;
            break;
        case IRP_MN_POWER_SEQUENCE: 
            irpMinorString = IRP_MN_POWER_SEQUENCE_STRING;
            break;
        case IRP_MN_SET_POWER: 
            irpMinorString = IRP_MN_SET_POWER_STRING;
            break;
        case IRP_MN_QUERY_POWER: 
            irpMinorString = IRP_MN_QUERY_POWER_STRING;
            break;
        default :
            sprintf(errorBuf,"Unknown Irp minor code (%u)",MinorCode);
            irpMinorString = errorBuf;
        }
        break;

    case IRP_MJ_SYSTEM_CONTROL:
        irpMajorString = IRP_MJ_SYSTEM_CONTROL_STRING;
        switch (MinorCode) {
        case IRP_MN_QUERY_ALL_DATA: 
            irpMinorString = IRP_MN_QUERY_ALL_DATA_STRING;
            break;
        case IRP_MN_QUERY_SINGLE_INSTANCE: 
            irpMinorString = IRP_MN_QUERY_SINGLE_INSTANCE_STRING;
            break;
        case IRP_MN_CHANGE_SINGLE_INSTANCE: 
            irpMinorString = IRP_MN_CHANGE_SINGLE_INSTANCE_STRING;
            break;
        case IRP_MN_CHANGE_SINGLE_ITEM: 
            irpMinorString = IRP_MN_CHANGE_SINGLE_ITEM_STRING;
            break;
        case IRP_MN_ENABLE_EVENTS: 
            irpMinorString = IRP_MN_ENABLE_EVENTS_STRING;
            break;
        case IRP_MN_DISABLE_EVENTS: 
            irpMinorString = IRP_MN_DISABLE_EVENTS_STRING;
            break;
        case IRP_MN_ENABLE_COLLECTION: 
            irpMinorString = IRP_MN_ENABLE_COLLECTION_STRING;
            break;
        case IRP_MN_DISABLE_COLLECTION: 
            irpMinorString = IRP_MN_DISABLE_COLLECTION_STRING;
            break;
        case IRP_MN_REGINFO: 
            irpMinorString = IRP_MN_REGINFO_STRING;
            break;
        case IRP_MN_EXECUTE_METHOD: 
            irpMinorString = IRP_MN_EXECUTE_METHOD_STRING;
            break;
        default :
            sprintf(errorBuf,"Unknown Irp minor code (%u)",MinorCode);
            irpMinorString = errorBuf;
        }
        break;

    case IRP_MJ_DEVICE_CHANGE:
        irpMajorString = IRP_MJ_DEVICE_CHANGE_STRING;
        break;
    case IRP_MJ_QUERY_QUOTA:
        irpMajorString = IRP_MJ_QUERY_QUOTA_STRING;
        break;
    case IRP_MJ_SET_QUOTA:
        irpMajorString = IRP_MJ_SET_QUOTA_STRING;
        break;
    case IRP_MJ_PNP:
        irpMajorString = IRP_MJ_PNP_STRING;
        switch (MinorCode) {
        case IRP_MN_START_DEVICE: 
            irpMinorString = IRP_MN_START_DEVICE_STRING;
            break;
        case IRP_MN_QUERY_REMOVE_DEVICE: 
            irpMinorString = IRP_MN_QUERY_REMOVE_DEVICE_STRING;
            break;
        case IRP_MN_REMOVE_DEVICE: 
            irpMinorString = IRP_MN_REMOVE_DEVICE_STRING;
            break;
        case IRP_MN_CANCEL_REMOVE_DEVICE: 
            irpMinorString = IRP_MN_CANCEL_REMOVE_DEVICE_STRING;
            break;
        case IRP_MN_STOP_DEVICE: 
            irpMinorString = IRP_MN_STOP_DEVICE_STRING;
            break;
        case IRP_MN_QUERY_STOP_DEVICE: 
            irpMinorString = IRP_MN_QUERY_STOP_DEVICE_STRING;
            break;
        case IRP_MN_CANCEL_STOP_DEVICE: 
            irpMinorString = IRP_MN_CANCEL_STOP_DEVICE_STRING;
            break;
        case IRP_MN_QUERY_DEVICE_RELATIONS: 
            irpMinorString = IRP_MN_QUERY_DEVICE_RELATIONS_STRING;
            break;
        case IRP_MN_QUERY_INTERFACE: 
            irpMinorString = IRP_MN_QUERY_INTERFACE_STRING;
            break;
        case IRP_MN_QUERY_CAPABILITIES: 
            irpMinorString = IRP_MN_QUERY_CAPABILITIES_STRING;
            break;
        case IRP_MN_QUERY_RESOURCES: 
            irpMinorString = IRP_MN_QUERY_RESOURCES_STRING;
            break;
        case IRP_MN_QUERY_RESOURCE_REQUIREMENTS: 
            irpMinorString = IRP_MN_QUERY_RESOURCE_REQUIREMENTS_STRING;
            break;
        case IRP_MN_QUERY_DEVICE_TEXT: 
            irpMinorString = IRP_MN_QUERY_DEVICE_TEXT_STRING;
            break;
        case IRP_MN_FILTER_RESOURCE_REQUIREMENTS: 
            irpMinorString = IRP_MN_FILTER_RESOURCE_REQUIREMENTS_STRING;
            break;
        case IRP_MN_READ_CONFIG: 
            irpMinorString = IRP_MN_READ_CONFIG_STRING;
            break;
        case IRP_MN_WRITE_CONFIG: 
            irpMinorString = IRP_MN_WRITE_CONFIG_STRING;
            break;
        case IRP_MN_EJECT: 
            irpMinorString = IRP_MN_EJECT_STRING;
            break;
        case IRP_MN_SET_LOCK: 
            irpMinorString = IRP_MN_SET_LOCK_STRING;
            break;
        case IRP_MN_QUERY_ID: 
            irpMinorString = IRP_MN_QUERY_ID_STRING;
            break;
        case IRP_MN_QUERY_PNP_DEVICE_STATE: 
            irpMinorString = IRP_MN_QUERY_PNP_DEVICE_STATE_STRING;
            break;
        case IRP_MN_QUERY_BUS_INFORMATION: 
            irpMinorString = IRP_MN_QUERY_BUS_INFORMATION_STRING;
            break;
        case IRP_MN_DEVICE_USAGE_NOTIFICATION: 
            irpMinorString = IRP_MN_DEVICE_USAGE_NOTIFICATION_STRING;
            break;
        case IRP_MN_SURPRISE_REMOVAL: 
            irpMinorString = IRP_MN_SURPRISE_REMOVAL_STRING;
            break;
        case IRP_MN_QUERY_LEGACY_BUS_INFORMATION: 
            irpMinorString = IRP_MN_QUERY_LEGACY_BUS_INFORMATION_STRING;
            break;
        default :
            sprintf(errorBuf,"Unknown Irp minor code (%u)",MinorCode);
            irpMinorString = errorBuf;
        }
        break;
    
    default:
        sprintf(errorBuf,"Unknown Irp major function (%u)",MajorCode);
        irpMajorString = errorBuf;
    }

    if (OutputFile) {
        if (irpMinorString) {
            sprintf(formatBuf,"%s  %s",irpMajorString, irpMinorString);
            fprintf(OutputFile, "\t%-50s", formatBuf);
        } else {
            fprintf(OutputFile, "\t%-50s", irpMajorString);
        }
    } else {
        if (PrintMajorCode) {
            printf("%-31s ", irpMajorString);
        } else {
            if (irpMinorString) {
                printf("                                                   %-35s\n",
                        irpMinorString);
            }
        }
    }
}

VOID
PrintFastIoType(
    FASTIO_TYPE   Code,
    FILE         *OutputFile
)
{
    CHAR *outputString;

    switch (Code) {
    case CHECK_IF_POSSIBLE:
        outputString = CHECK_IF_POSSIBLE_STRING;
        break;
    case READ:
        outputString = READ_STRING;
        break;
    case WRITE:
        outputString = WRITE_STRING;
        break;
    case QUERY_BASIC_INFO:
        outputString = QUERY_BASIC_INFO_STRING;
        break;
    case QUERY_STANDARD_INFO:
        outputString = QUERY_STANDARD_INFO_STRING;
        break;
    case LOCK:
        outputString = LOCK_STRING;
        break;
    case UNLOCK_SINGLE:
        outputString = UNLOCK_SINGLE_STRING;
        break;
    case UNLOCK_ALL:
        outputString = UNLOCK_ALL_STRING;
        break;
    case UNLOCK_ALL_BY_KEY:
        outputString = UNLOCK_ALL_BY_KEY_STRING;
        break;
    case DEVICE_CONTROL:
        outputString = DEVICE_CONTROL_STRING;
        break;
    case ACQUIRE_FILE:
        outputString = ACQUIRE_FILE_STRING;
        break;
    case RELEASE_FILE:
        outputString = RELEASE_FILE_STRING;
        break;
    case DETACH_DEVICE:
        outputString = DETACH_DEVICE_STRING;
        break;
    case QUERY_NETWORK_OPEN_INFO:
        outputString = QUERY_NETWORK_OPEN_INFO_STRING;
        break;
    case ACQUIRE_FOR_MOD_WRITE:
        outputString = ACQUIRE_FOR_MOD_WRITE_STRING;
        break;
    case MDL_READ:
        outputString = MDL_READ_STRING;
        break;
    case MDL_READ_COMPLETE:
        outputString = MDL_READ_COMPLETE_STRING;
        break;
    case MDL_WRITE:
        outputString = MDL_WRITE_STRING;
        break;
    case MDL_WRITE_COMPLETE:
        outputString = MDL_WRITE_COMPLETE_STRING;
        break;
    case READ_COMPRESSED:
        outputString = READ_COMPRESSED_STRING;
        break;
    case WRITE_COMPRESSED:
        outputString = WRITE_COMPRESSED_STRING;
        break;
    case MDL_READ_COMPLETE_COMPRESSED:
        outputString = MDL_READ_COMPLETE_COMPRESSED_STRING;
        break;
    case PREPARE_MDL_WRITE:
        outputString = PREPARE_MDL_WRITE_STRING;
        break;
    case MDL_WRITE_COMPLETE_COMPRESSED:
        outputString = MDL_WRITE_COMPLETE_COMPRESSED_STRING;
        break;
    case QUERY_OPEN:
        outputString = QUERY_OPEN_STRING;
        break;
    case RELEASE_FOR_MOD_WRITE:
        outputString = RELEASE_FOR_MOD_WRITE_STRING;
        break;
    case ACQUIRE_FOR_CC_FLUSH:
        outputString = ACQUIRE_FOR_CC_FLUSH_STRING;
        break;
    case RELEASE_FOR_CC_FLUSH:
        outputString = RELEASE_FOR_CC_FLUSH_STRING;
        break;
    default :
        outputString = "Unknown Fast I/O type";
        break;
    }

    if (OutputFile) {
        fprintf(OutputFile, "%-50s", outputString);
    } else {
        printf("%-31s ", outputString);
    }
}


/*++
Routine Name:
    
    FormatSystemTime

Routine Description:

    Formats the values in a SystemTime struct into the buffer 
    passed in.  The resulting string is NULL terminated.  The format
    for the time is:
        hours:minutes:seconds:milliseconds
    
Arguments:

    SystemTime - the struct to format
    Buffer - the buffer to place the formatted time in
    BufferLength - the size of the buffer

Return Value:

    The length of the string returned in Buffer.

--*/
ULONG
FormatSystemTime(
    SYSTEMTIME *SystemTime,
    CHAR       *Buffer,
    ULONG       BufferLength
)
{
    CHAR  *writePosition;
    ULONG  returnLength = 0;

    writePosition = Buffer;

    if (BufferLength < TIME_BUFFER_LENGTH) {
        // Buffer is too short so exit
        return 0;
    }

    returnLength = sprintf(