Miniflter中 NPInstanceSetup调查

 目的:绑定USB 存储设备(不绑定本地磁盘),实现只读,读写操作。

 实验环境:在NPInstanceSetup中,调试跟踪:

第一次进入:

入参:
VolumeDeviceType =
VolumeFilesystemType =

通过 FltGetVolumeProperties调用获取:

FilteSystemDriverName =    \FileSystem\MRxSmb\Device\LanmanRedirector  (没用)
FilterSystemDeviceName  =  \Device\LanmanRedirector\FileSystem\MRxSmb\Device

                                            \LanmanRedirector (没用)
RealDeviceName = \Device\LanmanRedirector
volProp->DeviceCharacteristics = 0
 

第二次进入:

入参:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)

通过 FltGetVolumeProperties调用获取:
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume5
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume5
RealDeviceName = \Device\HarddiskVolume5
DriverName = \Driver\VolSnap

第三次进入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume4
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume4
RealDeviceName = \Device\HarddiskVolume4

pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

第四次进入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume2
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume2
RealDeviceName = \Device\HarddiskVolume2
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

 

第五次进入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume3
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume3
RealDeviceName = \Device\HarddiskVolume3
volProp->DeviceCharacteristics = 0
DriverName = \Driver\VolSnap

第六次进入:

VolumeDeviceType = 8;
VolumeFilesystemType = FLT_FSTYPE_NTFS(2)
FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume1
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume1
RealDeviceName = \Device\HarddiskVolume1
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

第7次进入:

VolumeDeviceType    8
VolumeFileSystem    FLT_FSTYPE_RAW (1)
FilteSystemDriverName = \FileSystem\RAW\Device\Harddisk0\DR0?
FilterSystemDeviceName  = \Device\RawDisk\FileSystem\RAW\Device\Harddisk0\DR0?
RealDeviceName = \Device\Harddisk0\DR0?
volProp->DeviceCharacteristics = 100
RealDeviceName = \Device\Harddisk0\DR0?
pdevObj->Characteristics = 100

插入U盘:

FilteSystemDriverName = \FileSystem\Fastfat\Device\Harddisk1\DP(1)0-0+7?
FilterSystemDeviceName  = \Fat\FileSystem\Fastfat\Device\Harddisk1\DP(1)0-0+7?
RealDeviceName = \Device\Harddisk1\DP(1)0-0+7?
volProp->DeviceCharacteristics = 101
RealDeviceName = \Device\Harddisk1\DP(1)0-0+7?
pdevObj->Characteristics = 101

插入移动硬盘:

FilteSystemDriverName = \FileSystem\Ntfs\Device\HarddiskVolume6
FilterSystemDeviceName  = \Ntfs\FileSystem\Ntfs\Device\HarddiskVolume6
RealDeviceName = \Device\HarddiskVolume6
volProp->DeviceCharacteristics = 0
RealDeviceName = \Device\HarddiskVolume6
pdevObj->Characteristics = 0
DriverName = \Driver\VolSnap

 

很是郁闷,感觉这样也无法区分移动硬盘和本地磁盘,他们的Characteristics都为0!

感觉还是无法区分移动设备。

 

 

 

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章