Miniflter中 NPInstanceSetup調查

 目的:綁定USB 存儲設備(不綁定本地磁盤),實現只讀,讀寫操作。

 實驗環境:在NPInstanceSetup中,調試跟蹤:

第一次進入:

入參:
VolumeDeviceType =
VolumeFilesystemType =

通過 FltGetVolumeProperties調用獲取:

FilteSystemDriverName =    \FileSystem\MRxSmb\Device\LanmanRedirector  (沒用)
FilterSystemDeviceName  =  \Device\LanmanRedirector\FileSystem\MRxSmb\Device

                                            \LanmanRedirector (沒用)
RealDeviceName = \Device\LanmanRedirector
volProp->DeviceCharacteristics = 0
 

第二次進入:

入參:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)

通過 FltGetVolumeProperties調用獲取:
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume5
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume5
RealDeviceName = \Device\HarddiskVolume5
DriverName = \Driver\VolSnap

第三次進入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume4
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume4
RealDeviceName = \Device\HarddiskVolume4

pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

第四次進入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume2
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume2
RealDeviceName = \Device\HarddiskVolume2
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

 

第五次進入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume3
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume3
RealDeviceName = \Device\HarddiskVolume3
volProp->DeviceCharacteristics = 0
DriverName = \Driver\VolSnap

第六次進入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume1
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume1
RealDeviceName = \Device\HarddiskVolume1
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

第7次進入:

VolumeDeviceType    8
VolumeFileSystem    FLT_FSTYPE_RAW (1)
FilteSystemDriverName = \FileSystem\RAW\Device\Harddisk0\DR0?
FilterSystemDeviceName  = \Device\RawDisk\FileSystem\RAW\Device\Harddisk0\DR0?
RealDeviceName = \Device\Harddisk0\DR0?
volProp->DeviceCharacteristics = 100
RealDeviceName = \Device\Harddisk0\DR0?
pdevObj->Characteristics = 100

插入U盤:

FilteSystemDriverName = \FileSystem\Fastfat\Device\Harddisk1\DP(1)0-0+7?
FilterSystemDeviceName  = \Fat\FileSystem\Fastfat\Device\Harddisk1\DP(1)0-0+7?
RealDeviceName = \Device\Harddisk1\DP(1)0-0+7?
volProp->DeviceCharacteristics = 101
RealDeviceName = \Device\Harddisk1\DP(1)0-0+7?
pdevObj->Characteristics = 101

插入移動硬盤:

FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume6
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume6
RealDeviceName = \Device\HarddiskVolume6
volProp->DeviceCharacteristics = 0
RealDeviceName = \Device\HarddiskVolume6
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

 

很是鬱悶,感覺這樣也無法區分移動硬盤和本地磁盤,他們的Characteristics都爲0!

感覺還是無法區分移動設備。

 

 

 

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章