[求助]微过滤的PreCallback 和 PosCallback 处理I/O操作的顺序是否一样？-软件逆向-看雪-安全社区|安全招聘|kanxue.com

最新回复 (1)
DriverAsm 雪币： 22 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 11 回帖 146 粉丝 0 关注私信	DriverAsm 2 楼好吧、这个问题本身问得非常弱智～～～啥都不说了。 77fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8Y4N6A6L8X3c8G2N6%4y4Q4x3V1k6Z5j5i4u0V1N6$3q4J5k6g2)9J5c8X3k6X3y4e0f1I4x3e0l9&6i4K6t1^5N6W2)9K6c8s2k6K6i4K6u0W2z5o6g2Q4x3U0W2Q4x3X3g2S2M7%4m8^5 CompletionContext [out] If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to be passed to the corresponding post-operation callback routine. Otherwise, it must be NULL. f0aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8Y4N6A6L8X3c8G2N6%4y4Q4x3V1k6Z5j5i4u0V1N6$3q4J5k6g2)9J5c8X3k6X3y4e0f1I4x3e0l9%4i4K6t1^5N6W2)9K6c8s2k6K6i4K6u0W2z5o6g2Q4x3U0W2Q4x3X3g2S2M7%4m8^5 CompletionContext [in, optional] A context pointer that was returned by the minifilter driver's pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine. The CompletionContext pointer provides a way to communicate information from the pre-operation callback routine to the post-operation callback routine. 然后再参考一下 WDK7 sample minispy 对该参数的操作就能明白了～ 2013-6-18 16:27 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

最新回复 (1)

DriverAsm

雪币： 22

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

回帖

146

粉丝

关注

私信

DriverAsm: 2 楼

好吧、这个问题本身问得非常弱智～～～

啥都不说了。

77fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8Y4N6A6L8X3c8G2N6%4y4Q4x3V1k6Z5j5i4u0V1N6$3q4J5k6g2)9J5c8X3k6X3y4e0f1I4x3e0l9&6i4K6t1^5N6W2)9K6c8s2k6K6i4K6u0W2z5o6g2Q4x3U0W2Q4x3X3g2S2M7%4m8^5

CompletionContext [out]
If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to be passed to the corresponding post-operation callback routine. Otherwise, it must be NULL.

f0aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8Y4N6A6L8X3c8G2N6%4y4Q4x3V1k6Z5j5i4u0V1N6$3q4J5k6g2)9J5c8X3k6X3y4e0f1I4x3e0l9%4i4K6t1^5N6W2)9K6c8s2k6K6i4K6u0W2z5o6g2Q4x3U0W2Q4x3X3g2S2M7%4m8^5

CompletionContext [in, optional]
A context pointer that was returned by the minifilter driver's pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine. The CompletionContext pointer provides a way to communicate information from the pre-operation callback routine to the post-operation callback routine.

然后再参考一下 WDK7 sample minispy 对该参数的操作就能明白了～

2013-6-18 16:27