文件过滤驱动拦截的IRP主要包括以下几个:IRP_MJ_CREATE,文件创建操作,文件的任何操作,都是从这里开始的。IRP_MJ_CLEANUP,文件的HANDLE句柄全部关闭会触发这个消息IRP_MJ_CLOSE,文件对象 FILE_OBJECT引用减为0,文件对象即将被删除时触发。IRP_MJ Read More
posted @ 2016-10-09 04:52
findumars
Views(1944)
Comments(0)
Diggs(1)
http://download.csdn.net/user/fanxiushu/uploads/2 http://download.csdn.net/user/fanxiushu/uploads/1 Read More
posted @ 2016-10-09 04:26
findumars
Views(407)
Comments(0)
Diggs(0)