미니필터 드라이버에서 I/O 연산시 파일 풀패스명을 얻는 함수를 작성하였습니다.
미니필터 드라이버에서는 파일명 및 파일 정보를 얻기 위해 필터 매니저에서 제공하는 FltGetFileNameInformation() 함수를 사용하여 얻을 수 있지만 이 함수가 실패하는 경우가 있습니다. 그것도 자주…(자세한 내용은 WDK 도움말을 참조하십시오)
//파일 객체가 NULL 이거나 콜백 데이터가 NULL 인 경우 리턴
if(FltObjects->FileObject == NULL || Data == NULL)
{
Status = STATUS_UNSUCCESSFUL;
return Status;
}
//FLT_FILE_NAME_INFORMATION 정보를 쿼리
Status = FltGetFileNameInformation(Data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
&pFileNameInfo);
if(NT_SUCCESS(Status))
{
//FLT_FILE_NAME_INFORMATION 정보를 얻어 오면 OUT 인자에 풀패스 파일명 복사
if(pFileNameInfo->Name.Length > 0)
{
RtlUnicodeStringCopy(pFullPathName, &pFileNameInfo->Name);
}
}
else
{
//FLT_FILE_NAME_INFORMATION 정보를 얻어오지 못한 경우 FLT_FILE_NAME_OPENED 방식으로 다시 쿼리
Status = FltGetFileNameInformation(Data,
FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
&pFileNameInfo);
if(NT_SUCCESS(Status))
{
//FLT_FILE_NAME_INFORMATION 정보를 얻어 오면 OUT 인자에 풀패스 파일명 복사
if(pFileNameInfo->Name.Length > 0)
{
RtlUnicodeStringCopy(pFullPathName, &pFileNameInfo->Name);
}
}
else
{
//FltGetFileNameInformation() 함수로 파일 정보를 얻어오지 못하는 경우
//FileObject에 직접 접근하여 파일명을 얻어옴
//FileObject 에 있는 파일명은 볼륨(디바이스) 정보가 없는 풀 패스명이므로 볼륨명을 얻어서
//볼륨명 뒤에 FileObject의 파일명을 붙여서 풀패스명을 만듦
ULONG Size;
UNICODE_STRING szTempPath;
UNICODE_STRING szDevice;
UNICODE_STRING szFileNameDevice;
//FileObject->FileName 이 볼륨정보를 포함하고 있는지 체크
szFileNameDevice.Length = FltObjects->FileObject->FileName.Length;
szFileNameDevice.MaximumLength = FltObjects->FileObject->FileName.MaximumLength;
szFileNameDevice.Buffer = ExAllocatePoolWithTag(NonPagedPool, szFileNameDevice.MaximumLength, ‘iNiM’);
if(szFileNameDevice.Buffer == NULL)
{
return STATUS_UNSUCCESSFUL;
}
RtlInitUnicodeString(&szDevice, L”\\Device”);
if(FltObjects->FileObject->FileName.Length >= szDevice.Length)
{
RtlUnicodeStringCchCopyN(&szFileNameDevice, &FltObjects->FileObject->FileName, 7);
}
if(RtlEqualUnicodeString(&szDevice, &szFileNameDevice, TRUE))
{
RtlUnicodeStringCopy(pFullPathName, &FltObjects->FileObject->FileName);
}
else
{
//볼륨정보를 얻어와서 연결 시킴
szTempPath.Length = 0;
szTempPath.MaximumLength = FltObjects->FileObject->FileName.MaximumLength + 2;
Status = FltGetVolumeName(FltObjects->Volume, NULL, &Size);
if(Status == STATUS_BUFFER_TOO_SMALL)
{
szTempPath.MaximumLength += (USHORT)Size;
szTempPath.Buffer = ExAllocatePoolWithTag(NonPagedPool, szTempPath.MaximumLength, ‘iNiM’);
if(szTempPath.Buffer != NULL)
{
Status = FltGetVolumeName(FltObjects->Volume, &szTempPath, &Size);
if(NT_SUCCESS(Status))
{
RtlUnicodeStringCat(&szTempPath, &FltObjects->FileObject->FileName);
RtlUnicodeStringCopy(pFullPathName, &szTempPath);
}
ExFreePoolWithTag(szTempPath.Buffer, ‘iNiM’);
}
}
}
ExFreePoolWithTag(szFileNameDevice.Buffer, ‘iNiM’);
}
}
//FltGetFileNameInformation() 함수로 얻어온 FLT_FILE_NAME_INFORMATION 을 해제해 주어야 함
if(pFileNameInfo != NULL)
{
FltReleaseFileNameInformation(pFileNameInfo);
}
return Status;
}
위 함수는 Pre/Post Operation Callback 루틴에서 아래와 같이 사용하시면 됩니다.
NTSTATUS Status = STATUS_SUCCESS;
UNICODE_STRING FileName;
FileName.Length = 0;
FileName.MaximumLength = NTSTRSAFE_UNICODE_STRING_MAX_CCH * sizeof(WCHAR);
FileName.Buffer = ExAllocatePoolWithTag(NonPagedPool, FileName.MaximumLength, ‘iNiM’);
if(FileName.Buffer == NULL)
{
return STATUS_UNSUCCESSFUL;
}
Status = MiniGetFileName(Data, FltObjects, &FileName);
if(Status == STATUS_SUCCESS)
{
// FileName에 파일 풀패스 명이 넣어져서 리턴됨
}
ExFreePoolWithTag(FileName.Buffer, ‘iNiM’);
//코드 생략 …
}
※ 주의 : 코드는 실제 적용 코드에서 블로깅을 위해 수정된 것입니다. 사용하실때는 코드 검증및 테스트를 하시고 사용하시기 바랍니다.
미니필터 드라이버 기반 파일 모니터링 프로그램이 어느정도 완성되었습니다. 현재 테스트 중이고, 곧 업로드 하도록 하겠습니다.
[스크린샷]
소스 좀 구할 수 있을까요…?
RtlUnicodeString 함수들(RtlUnicodeStringCopy, RtlUnicodeStringCat, RtlUnicodeStringCopyN)이 정의되어 있지 않다고 하네요..ㅠㅠ… MSDN 가봐도 자세한 정보는 없고… 어찌해야 하나요..?
ntstrsafe.h 헤더를 Include 해야 합니다.
SOURCES 파일에는 ntstrsafe.lib 를 Link 하시면 됩니다.
그리고 위 헤더를 Include 하기 전에 #define NTSTRSAFE_LIB 선언해야 함을 유의하십시오.
미니필터를 시작으로 처음 드라이버를 개발하려는 학부생입니다.
키눅스 님이 만든 위에서 처럼 모니터링 어플을 개발해야되는데,
지금은 WDK7600 설치하고 예제 돌려가며 DebugView로
찍는 가난한 방법으로 공부하고있습니다.
혹여나, 개발 환경 구축방법, 코드 검증에 대해서
참고할 사이트, 문서, 관련 예제좀 알려주시면,
정말 감사하겠습니다.
kkongs86@gmail.com
핑백: emma stone
핑백: nikki reed
핑백: ernest hemingway
핑백: ernest hemingway
핑백: mark jackson
핑백: horton
핑백: icloud
핑백: mark jackson
핑백: andrew breitbart
핑백: lenny dykstra
핑백: icloud
핑백: lenny dykstra
핑백: nintendo 3ds
핑백: bioshock infinite
핑백: sign language
핑백: sign language
핑백: george stephanopoulos
핑백: icloud
핑백: economics
핑백: technology
핑백: justin timberlake and mila kunis
핑백: psychology
핑백: lauryn hill
핑백: os x lion
핑백: apple cloud
핑백: psychology
핑백: economics
핑백: human centipede
핑백: science
핑백: science
핑백: economics
핑백: justin timberlake and mila kunis
핑백: justin timberlake and mila kunis
핑백: apple cloud
핑백: shavuot
핑백: mlb draft
핑백: shavuot
핑백: printable contact lens solution coupon
핑백: ocean coloring page printable
핑백: printable father's day coupons
핑백: free printable moving announcement cards
핑백: free printable disney coloring
핑백: printables with two demensional shapes
핑백: free printable greeting cards halloween
핑백: printable blank calendar sheets
핑백: free printable perfect attendance certificates
핑백: printable drawings of hindu symbols
I have been looking for such information for many days.I have got to give a presentation about this.
whenever I see people like you which sharing information for other peoples, I feel so glad, thanks for your information and continue your work.
핑백: maplestory mining pickaxe
핑백: home wall art painting
핑백: socket 478 cpu upgrade
핑백: verizon wireless coverage map alaska
핑백: heart healthy diet and exercise
핑백: presbyterian hospital matthews
핑백: http://reversephonelookupcellnumbers.blogspot.com/
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: homepage
핑백: officialreversephone.com
핑백: how to run
핑백: cool page
핑백: cool page
핑백: Cool Page
핑백: Cool Page
핑백: cool Page
핑백: Cool Page
핑백: Cool Page
핑백: paydayloans
핑백: provillus results
핑백: provillus
핑백: www.101reversephonelookup.com/
핑백: payday loans site
핑백: pocket pussy
핑백: realistic vagina
핑백: equity release mortgage
핑백: payday loans no credit check
핑백: instant payday loans
핑백: yourtextloans.co.uk
핑백: instant loans
핑백: same day loans
핑백: payday advance
핑백: quick loan
핑백: http://www.bestneedcashnow.com
핑백: Read Full Article
핑백: web site
핑백: cash loans
핑백: Going Here
핑백: bestbadcreditpaydayloans.com
핑백: payday loan lenders
핑백: payday loan
핑백: adcloans
핑백: zap-payday-loans.co.uk
핑백: reverse cell phone lookup
핑백: instant payday loans online
핑백: http://www.cashadvancepanther.com
핑백: paydayloansmonk
핑백: cash advance
핑백: bad credit loans
핑백: how to lose weight fast
핑백: myinstantonlinepaydayloans.com
핑백: t8 led tubes
핑백: georgia payday loans
핑백: the flex belt results
핑백: free criminal background check australia
핑백: payday loans
핑백: long term loans
핑백: payday lenders
핑백: mybridgingloans
핑백: instant payday loans
핑백: small loans uk
핑백: diet solution program
핑백: payday loans
핑백: free background check mn
핑백: 500 calorie hcg diet menu
핑백: raspberry ketone
핑백: watch movies online
핑백: auto insurance in virginia
핑백: payday uk
핑백: オンラインカジノ
핑백: free online people finder
핑백: www.delightfulpaydayloans.co.uk
핑백: badcreditloansbuddy.co.uk
핑백: totally free reverse cell phone lookup with name
핑백: payday loans uk
핑백: cash advance
핑백: instant payday loans
핑백: sunshinepaydayloans
핑백: http://www.mrbadcreditloans.co.uk/
핑백: www.instantpaydayloansbuddy.co.uk
핑백: payday loans hero
핑백: buying a car with bad credit
핑백: free phone number lookup name
핑백: payday loans direct lender
핑백: payday loans no credit check
핑백: payday loan
핑백: payday loans
핑백: http://www.cheeky-payday.co.uk/
핑백: payday loan
핑백: pay day loans
핑백: http://www.bvnbvpaydayloans.co.uk/
핑백: short term loans
핑백: reverse phone lookup yellow pages
핑백: http://frppaydayloans.blogspot.com/
핑백: http://www.funkypaydayloans.co.uk/
핑백: http://www.funkypaydayloans.co.uk/
핑백: payday loans
핑백: payday loans
핑백: Onlinepaydayloansking.Co.Uk
핑백: Onlinepaydayloansking.Co.Uk
핑백: Cet Article
핑백: http://www.jhgfpaydayloans.co.uk/
핑백: payday loans
핑백: payday uk
핑백: click here
핑백: payday loans
핑백: www.simplesmallloans.com
핑백: payday uk
핑백: junakigroups.com
핑백: payday loans online
핑백: how to get a background check
핑백: unsecured loans
핑백: payday
핑백: payday loans no credit check
핑백: same day payday loans
핑백: cash loans
핑백: cash loans
핑백: payday loan online
핑백: cash loan
핑백: url
핑백: online casino
핑백: online casino
핑백: toploansforbadcreditdiamond.com
핑백: pay day loans
핑백: easy money advance
핑백: Tortilla Flat emetophobia treatment
핑백: http://www.fcbpersonalloans.co.uk/
핑백: payday loans
핑백: url
핑백: http://www.onlinecasinofest.com/
핑백: http://www.supercasinouk.co.uk/
핑백: http://www.fcbsecuredloans.co.uk/
핑백: online casinos
핑백: http://www.funkyscratchcards.co.uk/
핑백: http://www.dietsolutionfest.com/
핑백: url
핑백: http://www.fdeppiclaims.co.uk/
핑백: http://www.fabnewonlinecasino.co.uk/
핑백: penis advantage
핑백: raspberry ketones
핑백: http://www.miracleslotsuk.co.uk/
핑백: http://www.tastyonlinecasino.co.uk/
핑백: loans for bad credit
핑백: http://www.onlinecasinosuperb.com/
핑백: http://www.yourcasinobonusuk.co.uk/
핑백: the diet solution
핑백: make money online
핑백: penis enlargement
핑백: the diet solution
핑백: http://www.now-workathome.com/
핑백: http://www.mothersonlinecasino.co.uk/
핑백: http://www.topcasinoaustralia.com/
핑백: click here
핑백: scratch cards
핑백: http://www.mmplifeinsurance.co.uk/
핑백: click here
핑백: scratch cards
핑백: homepage
핑백: http://www.onlinecasinogalore.com/
핑백: http://www.reversephonelookupmaster.com/
핑백: url
핑백: http://www.bingo-galore.co.uk/
핑백: http://www.fldlifeinsurance.co.uk/
핑백: casino online
핑백: casino canada
핑백: http://www.dronlinecasino.com/
핑백: http://www.tedsonlinecasino.com/
핑백: Sublime carpal tunnel treatment
핑백: keep reading
핑백: free microsoft points emailed to you
핑백: call of duty black ops free microsoft points
핑백: Suggested Looking at
핑백: add microsoft points xbox free
핑백: free microsoft points codes list 2012 no surveys
핑백: free random microsoft points generator
핑백: your game hacks free microsoft points
핑백: sweatypalmsfix.com
핑백: best registry cleaner booster
핑백: bad credit loan
핑백: prettypaydayloansuk.co.uk/
핑백: cash advance
핑백: payday lender
핑백: instant payday loans
핑백: cashloansprince.co.uk/
핑백: power payday loans no credit check
핑백: wholesale gift cards
핑백: sale gift cards
핑백: discounted gift card
핑백: instantloanslion.co.uk/
핑백: fast payday advance
핑백: mypaydayadvanceuk.co.uk/
핑백: my advance payday loans
핑백: loan for bad credit
핑백: loan for bad credit
핑백: www.quickloanswizard.co.uk/
핑백: Payday Loan
핑백: instant payday loans
핑백: short term loans
핑백: no credit check loan
핑백: cash advances
핑백: www.paydayloansonlineocean.co.uk/
핑백: turn gift cards into cash
핑백: www.brightquickloans.co.uk/
핑백: www.easybestpaydayloansuk.co.uk/
핑백: search bug people finder
핑백: buy a car with bad credit
핑백: payday loans
핑백: text loan
핑백: pay day loans uk
핑백: http://www.ForeverBodyTransformationReview.info
핑백: http://www.fabfreebets.co.uk/
핑백: free bets uk
핑백: free bets uk
핑백: life insurance quotes
핑백: http://www.mmp-lifeinsurance.co.uk/
핑백: http://www.mmp-lifeinsurance.co.uk/
핑백: bingo sites
핑백: bingo sites
핑백: bingo
핑백: life insurance
핑백: life insurance quote
핑백: blackjack online
핑백: blackjack online
핑백: play online blackjack
핑백: http://www.miracle-slotsuk.co.uk/
핑백: online slots
핑백: slots online
핑백: http://www.fde-ppiclaims.co.uk/
핑백: reclaim ppi
핑백: http://www.fde-ppiclaims.co.uk/
핑백: http://www.penisenlargement-ultra.com/
핑백: http://www.penisenlargement-ultra.com/
핑백: http://www.penisenlargement-ultra.com/
핑백: payday loans
핑백: http://www.work-fromhome-today.com/
핑백: work from home
핑백: payday loans
핑백: payday loans uk
핑백: http://www.intellipaydayloansuk.co.uk/
핑백: pay day loans
핑백: motorbike insurance uk
핑백: motorbike insurance
핑백: motorbike insurance
핑백: LBA
핑백: Angel Capital Group
핑백: LBA
핑백: Angel Capital Group
핑백: Anthony Clarke
핑백: London Business Angels
핑백: motorbike insurance
핑백: motorcycle insurance
핑백: motorbike insurance
핑백: http://minecraftcodes.org/
핑백: Elkader hyperhidrosis treatment
핑백: Anthony Clarke
핑백: LBA
핑백: Angel Capital Group
핑백: reverse phone book
핑백: acupuncture back pain Osmond
핑백: carpal tunnel surgeons Lakehead
핑백: http://infotreeltd.com/rabunaimagee/index.php?option=com_blog
핑백: cwoca.com
핑백: www.pinkpaydayloansnocreditcheck.co.uk/
핑백: instant loan
핑백: www.yourinstantloansuk.co.uk/
핑백: yourinstantloansuk
핑백: payday text loans
핑백: text pay day loans
핑백: pay day text loans
핑백: cashadvancecarrot
핑백: cashadvancecarrot.co.uk/
핑백: payday loans uk
핑백: bestloansnocreditcheck
핑백: best loans no credit check
핑백: loans no credit check
핑백: same day loan
핑백: www.myfastcashloan.co.uk/
핑백: best pay day loans
핑백: mypaydayloansnocreditcheck4u
핑백: payday loans uk
핑백: mypaydayloansnocreditcheck4u
핑백: payday loans online
핑백: payday loans online
핑백: online payday loans
핑백: payday advance
핑백: www.mycashadvancepaydayloans.co.uk/
핑백: payday advance loans
핑백: myonlinepaydayloansnow.co.uk/
핑백: online payday loans
핑백: my online payday loans now
핑백: bad credit loan
핑백: www.badcreditloansworld.co.uk/
핑백: bad credit loans
핑백: cash advance
핑백: www.mycashloansonline.co.uk
핑백: cash loans online
핑백: cash loans online
핑백: instant payday loans
핑백: great text loans
핑백: txt loan
핑백: payday loan
핑백: www.bestinstantcashloans.co.uk/
핑백: best instant cash loans
핑백: www.bestinstantcashloans.co.uk/
핑백: toppaydayloansnocreditchecknow
핑백: payday loans no credit check
핑백: toppaydayloansnocreditchecknow.co.uk/
핑백: payday loans uk
핑백: payday advances uk
핑백: www.mypaydayloansuknow.co.uk/
핑백: free codes 2013
핑백: instant payday loan
핑백: top electronic cigarette
핑백: electronic cigarette
핑백: electronic cigarettes
핑백: e cigarette
핑백: electronic cigarettes
핑백: e cigarettes
핑백: www.superecigarette.co.uk
핑백: electronic cigarettes
핑백: www.superecigarette.co.uk
핑백: electronic cigarette
핑백: topecigarettes.co.uk
핑백: electronic cigarettes
핑백: free codes
핑백: e cigs
핑백: e cigs
핑백: e cigs
핑백: free itunes gift Codes
핑백: get free stuff
핑백: topecigs.co.uk
핑백: http://www.topecigs.co.uk/
핑백: electronic cigarette
핑백: v2 cigs
핑백: topecigsstore.com
핑백: www.topecigsstore.com
핑백: e-cigs
핑백: e cigs
핑백: e cigs
핑백: awesomecigs.com
핑백: electronic cigarettes
핑백: awesome cigs
핑백: myelectroniccigarettesstore.com
핑백: electronic cigarette
핑백: myelectroniccigarettesstore
핑백: v2 cigs
핑백: www.futureelectroniccigarettes.com
핑백: e cigarette
핑백: e cigarette
핑백: e cigarette
핑백: payday loans
핑백: payday loans uk
핑백: http://www.paydaybunnywabbit.co.uk/
핑백: http://www.paydayweirdo.co.uk/
핑백: http://www.paydayweirdo.co.uk/
핑백: http://www.paydayweirdo.co.uk/
핑백: my speedy bridging loans
핑백: http://www.myspeedybridgingloans.co.uk/
핑백: bridging loan
핑백: http://www.funky-scratchcards.co.uk/
핑백: http://www.funky-scratchcards.co.uk/
핑백: scratch cards
핑백: payday loan
핑백: payday loans
핑백: payday loans uk
핑백: electronic cigarette
핑백: best electronic cigarette shop
핑백: electronic cigarette
핑백: www.tope-cigs.com
핑백: electronic cigarettes
핑백: e-cigs
핑백: uniqueelectroniccigarette.com
핑백: uniqueelectroniccigarette
핑백: unique electronic cigarette
핑백: http://www.paydayweirdo.co.uk/
핑백: payday loans
핑백: pay day loans
핑백: http://www.paydayloansweirdo.co.uk/
핑백: payday loans uk
핑백: http://www.paydayloansweirdo.co.uk/
핑백: free codes for ms
핑백: pay day loans
핑백: pay day loans
핑백: pay day loans
핑백: payday loans
핑백: pay day loans
핑백: pay day loans
핑백: http://www.paydaydawg.co.uk/
핑백: payday loans