Minispy驱动程序-用户模式调用 [英] Minispy driver - user mode call

问题描述

在花了几个小时安装驱动程序之后，我开始研究minispy 驱动程序:

After hours of spending on installing drivers, I began looking at minispy driver:

Windows-driver-samples/filesys/miniFilter/minispy/

我正在尝试捕获用户打开文件的所有呼叫.我试图用它打印的所有参数(例如Opr，Major Operation ...)来做，但是我无法以确切的方式对其进行过滤.

I am trying to catch all the calls of user to open files. I was trying to do it with all the parameters it prints (like Opr, Major Operation...) but I can't filter it in exact way.

如何仅过滤用户呼叫(打开文件)? 如果用户调用了交易，如何在代码中确定?

How can I filter only the user calls (open file)?? How can I determinate within the code if the user called the transaction?

非常感谢您的帮助.

推荐答案

查找

look for FLT_CALLBACK_DATA.RequestorMode - if you use minifilter.

这篇关于Minispy驱动程序-用户模式调用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！