sfilter.c

文件系统过滤驱动的详细代码,含有中文说明及注释

                        FileOffset,
                        Length,
                        LockKey,
                        Buffer,
                        MdlChain,
                        IoStatus,
                        CompressedDataInfo,
                        CompressedDataInfoLength,
                        nextDeviceObject );
        }
    }
    return FALSE;
}


BOOLEAN  SfFastIoMdlReadCompleteCompressed( IN PFILE_OBJECT FileObject, IN PMDL MdlChain, IN PDEVICE_OBJECT DeviceObject )
{
    PDEVICE_OBJECT nextDeviceObject;
    PFAST_IO_DISPATCH fastIoDispatch;

    if (DeviceObject->DeviceExtension)
	{
		ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));
		nextDeviceObject = ((PSFILTER_DEVICE_EXTENSION) DeviceObject->DeviceExtension)->AttachedToDeviceObject;
		ASSERT(nextDeviceObject);
		fastIoDispatch = nextDeviceObject->DriverObject->FastIoDispatch;
		if (VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlReadCompleteCompressed ))
		{
			return (fastIoDispatch->MdlReadCompleteCompressed)(
                        FileObject,
                        MdlChain,
                        nextDeviceObject );
        }
    }
    return FALSE;
}

BOOLEAN  SfFastIoMdlWriteCompleteCompressed( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN PMDL MdlChain, IN PDEVICE_OBJECT DeviceObject )
{
    PDEVICE_OBJECT nextDeviceObject;
    PFAST_IO_DISPATCH fastIoDispatch;

    if (DeviceObject->DeviceExtension) {

        ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));
        nextDeviceObject = ((PSFILTER_DEVICE_EXTENSION) DeviceObject->DeviceExtension)->AttachedToDeviceObject;
        ASSERT(nextDeviceObject);

        fastIoDispatch = nextDeviceObject->DriverObject->FastIoDispatch;

        if (VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlWriteCompleteCompressed )) {

            return (fastIoDispatch->MdlWriteCompleteCompressed)(
                        FileObject,
                        FileOffset,
                        MdlChain,
                        nextDeviceObject );
        }
    }
    return FALSE;
}


BOOLEAN  SfFastIoQueryOpen( IN PIRP Irp, OUT PFILE_NETWORK_OPEN_INFORMATION NetworkInformation, IN PDEVICE_OBJECT DeviceObject )
{
    PDEVICE_OBJECT nextDeviceObject;
    PFAST_IO_DISPATCH fastIoDispatch;
    BOOLEAN result;

    PAGED_CODE();

    if (DeviceObject->DeviceExtension)
	{
		ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));
		nextDeviceObject = ((PSFILTER_DEVICE_EXTENSION) DeviceObject->DeviceExtension)->AttachedToDeviceObject;
		ASSERT(nextDeviceObject);
		fastIoDispatch = nextDeviceObject->DriverObject->FastIoDispatch;
		if (VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoQueryOpen ))
		{
			PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation( Irp );
			irpSp->DeviceObject = nextDeviceObject;
			result = (fastIoDispatch->FastIoQueryOpen)(
                        Irp,
                        NetworkInformation,
                        nextDeviceObject );

            irpSp->DeviceObject = DeviceObject;
            return result;
        }
    }
    return FALSE;
}

#if WINVER >= 0x0501
//========================== FSFilter 回调函数 ===========================
NTSTATUS  SfPreFsFilterPassThrough( IN PFS_FILTER_CALLBACK_DATA Data, OUT PVOID *CompletionContext )
{
    UNREFERENCED_PARAMETER( Data );
    UNREFERENCED_PARAMETER( CompletionContext );

    ASSERT( IS_MY_DEVICE_OBJECT( Data->DeviceObject ) );

    return STATUS_SUCCESS;
}

VOID  SfPostFsFilterPassThrough ( IN PFS_FILTER_CALLBACK_DATA Data, IN NTSTATUS OperationStatus, IN PVOID CompletionContext )
{
    UNREFERENCED_PARAMETER( Data );
    UNREFERENCED_PARAMETER( OperationStatus );
    UNREFERENCED_PARAMETER( CompletionContext );

    ASSERT( IS_MY_DEVICE_OBJECT( Data->DeviceObject ) );
}
#endif

//============================= 支持函数 =============================
NTSTATUS  SfAttachDeviceToDeviceStack( IN PDEVICE_OBJECT SourceDevice, IN PDEVICE_OBJECT TargetDevice, IN OUT PDEVICE_OBJECT *AttachedToDeviceObject )
{

    PAGED_CODE();

#if WINVER >= 0x0501

    if (IS_WINDOWSXP_OR_LATER())
	{
		ASSERT( NULL != gSfDynamicFunctions.AttachDeviceToDeviceStackSafe );
		return (gSfDynamicFunctions.AttachDeviceToDeviceStackSafe)( SourceDevice, TargetDevice, AttachedToDeviceObject );
	}
	else
	{
		ASSERT( NULL == gSfDynamicFunctions.AttachDeviceToDeviceStackSafe );
#endif

        *AttachedToDeviceObject = TargetDevice;
        *AttachedToDeviceObject = IoAttachDeviceToDeviceStack( SourceDevice, TargetDevice );

        if (*AttachedToDeviceObject == NULL)
		{
			return STATUS_NO_SUCH_DEVICE;
        }

        return STATUS_SUCCESS;

#if WINVER >= 0x0501
    }
#endif
}
//======================= 完成对文件系统控制设备的绑定 =======================
NTSTATUS  SfAttachToFileSystemDevice( IN PDEVICE_OBJECT DeviceObject, IN PUNICODE_STRING DeviceName )
{
    PDEVICE_OBJECT newDeviceObject;													//新设备对象
    PSFILTER_DEVICE_EXTENSION devExt;												//文件系统过滤驱动定义的设备扩展
    NTSTATUS status;																			//状态码
    UNICODE_STRING fsrecName;															//
    UNICODE_STRING fsName;																//文件系统名
    WCHAR tempNameBuffer[MAX_DEVNAME_LENGTH];								//临时缓冲区(存放名字串)

    PAGED_CODE();

    if (!IS_DESIRED_DEVICE_TYPE(DeviceObject->DeviceType))					//测试给定设备是不是所需要关心的设备
	{
		return STATUS_SUCCESS;
	}
	
	RtlInitEmptyUnicodeString( &fsName, tempNameBuffer, sizeof(tempNameBuffer) );
	
	if (!FlagOn(SfDebug,SFDEBUG_ATTACH_TO_FSRECOGNIZER))
	{
		RtlInitUnicodeString( &fsrecName, L"\\FileSystem\\Fs_Rec" );
		SfGetObjectName( DeviceObject->DriverObject, &fsName );
		if (RtlCompareUnicodeString( &fsName, &fsrecName, TRUE ) == 0)
		{
			return STATUS_SUCCESS;
		}
	}

    status = IoCreateDevice( gSFilterDriverObject,
                             sizeof( SFILTER_DEVICE_EXTENSION ),
                             NULL,
                             DeviceObject->DeviceType,
                             0,
                             FALSE,
                             &newDeviceObject );

    if (!NT_SUCCESS( status ))
	{
		return status;
	}

    if ( FlagOn( DeviceObject->Flags, DO_BUFFERED_IO ))
	{
		SetFlag( newDeviceObject->Flags, DO_BUFFERED_IO );								//
	}

    if ( FlagOn( DeviceObject->Flags, DO_DIRECT_IO ))
	{
		SetFlag( newDeviceObject->Flags, DO_DIRECT_IO );									//
	}

    if ( FlagOn( DeviceObject->Characteristics, FILE_DEVICE_SECURE_OPEN ) )
	{
		SetFlag( newDeviceObject->Characteristics, FILE_DEVICE_SECURE_OPEN );		//
    }

	devExt = newDeviceObject->DeviceExtension;
	status = SfAttachDeviceToDeviceStack( newDeviceObject, DeviceObject,  &devExt->AttachedToDeviceObject );
	if (!NT_SUCCESS( status ))
	{
		goto ErrorCleanupDevice;
	}

	RtlInitEmptyUnicodeString( &devExt->DeviceName, devExt->DeviceNameBuffer, sizeof(devExt->DeviceNameBuffer) );
    RtlCopyUnicodeString( &devExt->DeviceName, DeviceName );        //Save Name
    ClearFlag( newDeviceObject->Flags, DO_DEVICE_INITIALIZING );
	SF_LOG_PRINT( SFDEBUG_DISPLAY_ATTACHMENT_NAMES,
                  ("SFilter!SfAttachToFileSystemDevice:          Attaching to file system   %p \"%wZ\" (%s)\n",
                   DeviceObject,
                   &devExt->DeviceName,
                   GET_DEVICE_TYPE_NAME(newDeviceObject->DeviceType)) );
 
#if WINVER >= 0x0501

    if (IS_WINDOWSXP_OR_LATER())
	{
		ASSERT( NULL != gSfDynamicFunctions.EnumerateDeviceObjectList &&
                NULL != gSfDynamicFunctions.GetDiskDeviceObject &&
                NULL != gSfDynamicFunctions.GetDeviceAttachmentBaseRef &&
                NULL != gSfDynamicFunctions.GetLowerDeviceObject );

		status = SfEnumerateFileSystemVolumes( DeviceObject, &fsName );
		if (!NT_SUCCESS( status ))
		{
			IoDetachDevice( devExt->AttachedToDeviceObject );
			goto ErrorCleanupDevice;
		}
	}

#endif

    return STATUS_SUCCESS;

    ErrorCleanupDevice:
		SfCleanupMountedDevice( newDeviceObject );
		IoDeleteDevice( newDeviceObject );

    return status;
}

VOID  SfDetachFromFileSystemDevice( IN PDEVICE_OBJECT DeviceObject )
{
    PDEVICE_OBJECT ourAttachedDevice;
    PSFILTER_DEVICE_EXTENSION devExt;

    PAGED_CODE();

	ourAttachedDevice = DeviceObject->AttachedDevice;
	while (NULL != ourAttachedDevice)
	{
		if (IS_MY_DEVICE_OBJECT( ourAttachedDevice ))
		{
			devExt = ourAttachedDevice->DeviceExtension;
			SF_LOG_PRINT( SFDEBUG_DISPLAY_ATTACHMENT_NAMES,
                          ("SFilter!SfDetachFromFileSystemDevice:        Detaching from file system %p \"%wZ\" (%s)\n",
                           devExt->AttachedToDeviceObject,
                           &devExt->DeviceName,
                           GET_DEVICE_TYPE_NAME(ourAttachedDevice->DeviceType)) );
			
			SfCleanupMountedDevice( ourAttachedDevice );
            IoDetachDevice( DeviceObject );
            IoDeleteDevice( ourAttachedDevice );

            return;
        }
		
		DeviceObject = ourAttachedDevice;
        ourAttachedDevice = ourAttachedDevice->AttachedDevice;
    }
}

#if WINVER >= 0x0501
NTSTATUS  SfEnumerateFileSystemVolumes( IN PDEVICE_OBJECT FSDeviceObject, IN PUNICODE_STRING Name ) 
{
    PDEVICE_OBJECT newDeviceObject;
    PSFILTER_DEVICE_EXTENSION newDevExt;
    PDEVICE_OBJECT *devList;
    PDEVICE_OBJECT storageStackDeviceObject;
    NTSTATUS status;
    ULONG numDevices;
    ULONG i;
    BOOLEAN isShadowCopyVolume;

    PAGED_CODE();
	
	status = (gSfDynamicFunctions.EnumerateDeviceObjectList)(
                    FSDeviceObject->DriverObject,
                    NULL,
                    0,
                    &numDevices);
	
	if (!NT_SUCCESS( status ))
	{
		ASSERT(STATUS_BUFFER_TOO_SMALL == status);
		numDevices += 8;        //grab a few extra slots
		devList = ExAllocatePoolWithTag( NonPagedPool, (numDevices * sizeof(PDEVICE_OBJECT)), SFLT_POOL_TAG );
		if (NULL == devList)
		{
			return STATUS_INSUFFICIENT_RESOURCES;
		}
		
		ASSERT( NULL != gSfDynamicFunctions.EnumerateDeviceObjectList );
		status = (gSfDynamicFunctions.EnumerateDeviceObjectList)(
                        FSDeviceObject->DriverObject,
                        devList,
                        (numDevices * sizeof(PDEVICE_OBJECT)),
                        &numDevices);
		
		if (!NT_SUCCESS( status ))
		{
			ExFreePool( devList );
			return status;
		}
		
		for (i=0; i < numDevices; i++)
		{
			storageStackDeviceObject = NULL;
			try {
				
				if ((devList[i] == FSDeviceObject) || (devList[i]->DeviceType != FSDeviceObject->DeviceType) || SfIsAttachedToDevice( devList[i], NULL ))
				{
					leave;
				}
				
				SfGetBaseDeviceObjectName( devList[i], Name );
				if (Name->Length > 0)
				{
					leave;
				}
				
				ASSERT( NULL != gSfDynamicFunctions.GetDiskDeviceObject );
                status = (gSfDynamicFunctions.GetDiskDeviceObject)( devList[i], &storageStackDeviceObject );

                if (!NT_SUCCESS( status ))
				{
					leave;
				}
				
				status = SfIsShadowCopyVolume ( storageStackDeviceObject, &isShadowCopyVolume );

                if (NT_SUCCESS(status) &&
                    isShadowCopyVolume &&
                    !FlagOn(SfDebug,SFDE