函数
//得到对应卷的实例
PFLT_INSTANCE
XBFltGetVolumeInstance(
IN PFLT_FILTER pFilter,
IN PUNICODE_STRING pVolumeName
)
{
NTSTATUS status;
PFLT_INSTANCE pInstance = NULL;
PFLT_VOLUME pVolumeList[MAX_VOLUME_CHARS];
BOOLEAN bDone = FALSE;
ULONG uRet;
UNICODE_STRING uniName ={0};
ULONG index = 0;
WCHAR wszNameBuffer[MAX_PATH] = {0};
status = FltEnumerateVolumes(pFilter,
NULL,
0,
&uRet);
if(status != STATUS_BUFFER_TOO_SMALL)
{
return NULL;
}
status = FltEnumerateVolumes(pFilter,
pVolumeList,
uRet,
&uRet);
if(!NT_SUCCESS(status))
{
return NULL;
}
uniName.Buffer = wszNameBuffer;
if (uniName.Buffer == NULL)
{
for (index = 0;index< uRet; index++)
FltObjectDereference(pVolumeList[index]);
return NULL;
}
uniName.MaximumLength = MAX_PATH*sizeof(WCHAR);
for (index = 0; index < uRet; index++)
{
uniName.Length = 0;
status = FltGetVolumeName( pVolumeList[index],
&uniName,
NULL);
if(!NT_SUCCESS(status))
continue;
if(RtlCompareUnicodeString(&uniName,
pVolumeName,
TRUE) != 0)
continue;
status = FltGetVolumeInstanceFromName(pFilter,
pVolumeList[index],
NULL,
&pInstance);
if(NT_SUCCESS(status))
{
FltObjectDereference(pInstance);
break;
}
}
for (index = 0;index< uRet; index++)
FltObjectDereference(pVolumeList[index]);
return pInstance;
}
以下是怎么使用
//获得文件所在盘的实例
PFLT_INSTANCE fileInstance = NULL;
UNICODE_STRING pVolumeNamec;
RtlInitUnicodeString(&pVolumeNamec, L"\\Device\\HarddiskVolume2");//所在的卷
fileInstance = XBFltGetVolumeInstance(gFilterHandle, &pVolumeNamec);