如何在minifilter驱动程序中取消重命名操作 [英] How to cancel a rename operation in minifilter driver

问题描述

我想取消我的微型过滤器中的重命名操作.我写了 检测文件何时被重命名的代码，但是我不清楚如何 实际取消操作.有人可以帮我吗?

I would like to cancel a rename operation in my minifilter. I've written the code that detects when a file is being rename, but I'm unclear on how to actually cancel the operation. Can anyone help me out with this?

这是我的回调例程，用于检测文件重命名.

Here is my callback routine that detects for file rename.

FLT_PREOP_CALLBACK_STATUS
PreSetInformation(
    _Inout_ PFLT_CALLBACK_DATA Cbd,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
{   
    if (Cbd->Iopb->Parameters.SetFileInformation.FileInformationClass == FileRenameInformation)
    {
        WCHAR buf[MAX_PATH] = { 0 };
        PFILE_RENAME_INFORMATION renameInfo = Cbd->Iopb->Parameters.SetFileInformation.InfoBuffer;
        memcpy(buf, renameInfo->FileName, renameInfo->FileNameLength);
        DbgPrint("renameInfo %ws\n", buf);

        if (anCondition(buf))
        {
            // TO DO: cancel a rename
        }
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

推荐答案

您需要填充Cbd->IoStatus和return FLT_PREOP_COMPLETE 所以在您的代码中:

you need fill Cbd->IoStatus and return FLT_PREOP_COMPLETE so in your code:

if (anCondition(buf))
{
    // TO DO: cancel a rename
    Cbd->IoStatus.Status = <some_status>;
    Cbd->IoStatus.Information = <some_information>;//usually 0
    return FLT_PREOP_COMPLETE;
}

这篇关于如何在minifilter驱动程序中取消重命名操作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！