NTFS簇的加密操作
NtQueryDirectoryFile
± NtFsControlFile
± NtFsControlFile is used with FSCTL_XXX codes only!(They generate different IRP_MJ_XXX requests).
± This function is used to send File System Control (FSCTL) commands into file system drivers. Its definition is in ntdll.dll (ntdll.lib), a file shipped with the NTDDK
No.1:
NTSTATUS NtFsControlFile(
HANDLE FileHandle,
HANDLE Event, // optional
PIO_APC_ROUTINE ApcRoutine, // optional
PVOID ApcContext, // optional
PIO_STATUS_BLOCK IoStatusBlock,
ULONG FsControlCode,
PVOID InputBuffer, // optional
ULONG InputBufferLength,
PVOID OutputBuffer, // optional
ULONG OutputBufferLength
);
No.2:
NTSTATUS NtFsControlFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
);