u013176866
GooseTree
采纳率33.3%
2016-05-17 08:59

过滤驱动禁止U盘读写(非注册表)

张帆的《Windows 驱动开发技术详解》中有一个U盘过滤驱动,实现U盘的只读锁定。我想在某种情况下实现U盘的读写锁定。因为我想做一个密码的判断,所以不可能手动对注册表修改来实现这个功能。运行实例代码是好的。但是我加了一个对读操作请求的处理,然后Windows7 32bit测试机立刻蓝屏。代码如下:

 NTSTATUS
USBSCSICompletion( IN PDEVICE_OBJECT DeviceObject,
                   IN PIRP Irp,
                   IN PVOID Context )
{
    PDEVICE_EXTENSION pdx = ( PDEVICE_EXTENSION )
                                   DeviceObject->DeviceExtension;

    IoAcquireRemoveLock(&pdx->RemoveLock,Irp);

    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp );

    PSCSI_REQUEST_BLOCK CurSrb=irpStack->Parameters.Scsi.Srb; 
    PCDB cdb = (PCDB)CurSrb->Cdb; 
    UCHAR opCode=cdb->CDB6GENERIC.OperationCode; 

    if(opCode==SCSIOP_MODE_SENSE  && CurSrb->DataBuffer 
        && CurSrb->DataTransferLength >= 
        sizeof(MODE_PARAMETER_HEADER))
    {
        KdPrint(("SCSIOP_MODE_SENSE comming!\n"));

        PMODE_PARAMETER_HEADER modeData = (PMODE_PARAMETER_HEADER)CurSrb->DataBuffer;

        modeData->DeviceSpecificParameter |= MODE_DSP_WRITE_PROTECT;
    } 

    if (opCode == SCSIOP_READ)
    {
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
    }

    if ( Irp->PendingReturned )
    {
        IoMarkIrpPending( Irp );
    } 

    IoReleaseRemoveLock(&pdx->RemoveLock,Irp);

    return Irp->IoStatus.Status ;
} 

蓝屏log

 PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 0007e861, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

貌似是写锁定和 读锁定两个的方法冲突了。

还请大神指点指点!谢谢!

  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 复制链接分享
  • 邀请回答

相关推荐