作業系統會傳送 IRP_MJ_QUERY_INFORMATION 要求,以取得檔案或檔案控制代碼的相關中繼資料。 例如,當驅動程式呼叫 ZwQueryInformationFile時,作業系統會傳送 IRP_MJ_QUERY_INFORMATION 要求。輸入參數Parameters.QueryFile.FileInformationClass成員是一個FILE_INFORMATION_CLASS常數,指定要提供的元資料類型。 如需元資料類型...
The AssociatedIrp.SystemBuffer member points to a FILE_STANDARD_INFORMATION structure that the client allocates for output of file information. The Parameters.QueryFile.Length member is set to the size, in bytes, of a FILE_STANDARD_INFORMATION structure. FilePositionInformation request AssociatedIrp.Syst...
Drivers can optionally handle an IRP_MJ_QUERY_INFORMATION request.When SentThe operating system sends an IRP_MJ_QUERY_INFORMATION request to obtain metadata about a file or file handle. For example, when a driver calls ZwQueryInformationFile, the operating system sends an IRP_MJ_QUERY_INFORMATION...
Drivers can optionally handle an IRP_MJ_QUERY_INFORMATION request.When SentThe operating system sends an IRP_MJ_QUERY_INFORMATION request to obtain metadata about a file or file handle. For example, when a driver calls ZwQueryInformationFile, the operating system sends an IRP_MJ_QUERY_INFORMATION...
IRP_MJ_QUERY_INFORMATION IRP_MJ_READ IRP_MJ_SET_INFORMATION IRP_MJ_SHUTDOWN IRP_MJ_SYSTEM_CONTROL IRP_MJ_WRITE I/O Stack Locations I/O Status Blocks Passing IRPs down the Driver Stack Creating IRPs for Lower-Level Drivers Queuing and Dequeuing IRPs ...
IRP_MJ_CREATE_MAILSLOT IRP_MJ_CREATE_NAMED_PIPE IRP_MJ_DEVICE_CONTROL IRP_MJ_DIRECTORY_CONTROL IRP_MJ_FILE_SYSTEM_CONTROL IRP_MJ_FLUSH_BUFFERS IRP_MJ_INTERNAL_DEVICE_CONTROL IRP_MJ_LOCK_CONTROL IRP_MJ_PNP IRP_MJ_QUERY_EA IRP_MJ_QUERY_INFORMATION ...
IrpSp->FileObject should point to NULL for PnP IRPs. IrpSp->MajorFunction is set to IRP_MJ_PNP. IrpSp->MinorFunction is set to one of the following values: IRP_MN_CANCEL_REMOVE_DEVICE IRP_MN_QUERY_REMOVE_DEVICE IRP_MN_REMOVE_DEVICE IRP_MN_START_DEVICE IRP_MN_SURPRISE_REMOVALSee...
The FileQuotaInformation information class is obsolete. IRP_MJ_QUERY_QUOTA should be used instead.The file system driver should complete the IRP after it performs the requested operation.Operation: Legacy File System Filter DriversThe filter driver must pass this IRP down to the next-lower driver ...
(1) 在 IRP_MJ_READ 和 IRP_MJ_WRITE 操作里,假如最上层的 device object 的 flags 提供了 DO_BUFFERED_IO (2) 在 IRP_MJ_DEVICE_CONTROL 操作里,假如 I/O control code 指示需要 buffer。调用 WriteFile() 或者 DeviceIoControl() 用作输入 data I/O manager 复制 user-mode data buffer 到 kernel-...
分别为IRP_MJ_QUERY_INFORMATIONIRP_MJ_SET_INFORMATIONIRP_MJ_READIRP_MJ_WRITE,建议大家也去看看,是非常好的参考资料.但这里没有写到IRP_MJ_CREATE的填写,于是我参考着这些资料填写IRP然后IoCallDriver,当然不成功拉.于是我跳过它先做IRP_MJ_DIRECTORY_CONTROL的,也就是平时枚举文件用的NtQueryDirectoryFile最终要...