Notepad 打开文本文件所看到的 IRP

最新推荐文章于 2021-01-09 00:15:06 发布
最新推荐文章于 2021-01-09 00:15:06 发布
阅读量3.7k 收藏
点赞数
分类专栏： 操作系统
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/free2o/article/details/24234455
版权

双击打开文本文件，看到notepad 发了下面这些 IRP



IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
IRP_MJ_QUERY_INFORMATION
IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
--------------------------------------------------------------------
IRP_MJ_CREATE
IRP_MJ_QUERY_VOLUME_INFORMATION
IRP_MJ_QUERY_INFORMATION
IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
IRP_MJ_QUERY_INFORMATION
IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
IRP_MJ_CLEANUP
IRP_MJ_CLOSE


==================================================================================

FLock!FLockInstanceSetup: Entered
--> IRP_MJ_NETWORK_QUERY_OPEN , FileObject=EDB85CC0, FileName= \works\enc\vtest.txt , Process= Uncom.exe
============IRP_MJ_NETWORK_QUERY_OPEN===========>>>
FLock!FLockPostOperation: FileObject is : EDB85CC0
FLock!FLockPostOperation: FileObject->FsContext is : 00000000
FLock!FLockPostOperation: FileObject->FsContext2 is : 00000000
FLock!FLockPostOperation: FileObject->Vpb is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLock!FLockPreOperation: -Trace Log for FileName == \WORKS\ENC\VTEST.TXT
============FLockCreatePreOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : 00000000
FLock!FLockPostOperation: FileObject->FsContext2 is : 00000000
FLock!FLockPostOperation: FileObject->Vpb is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLock!FLockCreatePostOperation: -Trace Log for FileName == \works\enc\vtest.txt
============FLockCreatePostOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_QUERY_INFORMATION , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_QUERY_INFORMATION===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLockPreReadOperation
========Dump IRP Read Parameter===============>>>
Read.Length  is : 0x00001000
Read.ByteOffset.HighPart  is : 0x00000000
Read.ByteOffset.LowPart  is : 0x00000000
Read.ReadBuffer  is : 00000000
Read.MdlAddress  is : 86B25DD8
<<<=========Dump IRP Read Parameter==============
============FLockPreReadOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_CLEANUP , FileObject=86CEAE70, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_CLEANUP===========>>>
FLock!FLockPostOperation: FileObject is : 86CEAE70
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E3305AB0
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86E53D80
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86B9B520
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_NETWORK_QUERY_OPEN , FileObject=EDB85CC0, FileName= \works\enc\vtest.txt , Process= Uncom.exe
============IRP_MJ_NETWORK_QUERY_OPEN===========>>>
FLock!FLockPostOperation: FileObject is : EDB85CC0
FLock!FLockPostOperation: FileObject->FsContext is : 00000000
FLock!FLockPostOperation: FileObject->FsContext2 is : 00000000
FLock!FLockPostOperation: FileObject->Vpb is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLock!FLockPreOperation: -Trace Log for FileName == \works\enc\vtest.txt
============FLockCreatePreOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : 00000000
FLock!FLockPostOperation: FileObject->FsContext2 is : 00000000
FLock!FLockPostOperation: FileObject->Vpb is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLock!FLockCreatePostOperation: -Trace Log for FileName == \works\enc\vtest.txt
============FLockCreatePostOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_QUERY_VOLUME_INFORMATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_QUERY_VOLUME_INFORMATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_QUERY_INFORMATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_QUERY_INFORMATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_QUERY_INFORMATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_QUERY_INFORMATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_CLEANUP , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_CLEANUP===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
FLockPreReadOperation
========Dump IRP Read Parameter===============>>>
Read.Length  is : 0x00001000
Read.ByteOffset.HighPart  is : 0x00000000
Read.ByteOffset.LowPart  is : 0x00000000
Read.ReadBuffer  is : 00000000
Read.MdlAddress  is : 86B24E28
<<<=========Dump IRP Read Parameter==============
============FLockPreReadOperation===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
--> IRP_MJ_NETWORK_QUERY_OPEN , FileObject=ED94ACC0, FileName= \works\enc\vtest.txt , Process= notepad.exe
============IRP_MJ_NETWORK_QUERY_OPEN===========>>>
--> IRP_MJ_QUERY_INFORMATION , FileObject=86B66D08, FileName= \works\enc\vtest.txt , Process= System
FLock!FLockPostOperation: FileObject is : ED94ACC0
FLock!FLockPostOperation: FileObject->FsContext is : 00000000
FLock!FLockPostOperation: FileObject->FsContext2 is : 00000000
FLock!FLockPostOperation: FileObject->Vpb is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================
============IRP_MJ_QUERY_INFORMATION===========>>>
FLock!FLockPostOperation: FileObject is : 86B66D08
FLock!FLockPostOperation: FileObject->FsContext is : E3305958
FLock!FLockPostOperation: FileObject->FsContext2 is : E1A313F8
FLock!FLockPostOperation: FileObject->Vpb is : 86E3D1F0
FLock!FLockPostOperation: FileObject->SectionObjectPointer is : 86D75078
FLock!FLockPostOperation: FileObject->SectionObjectPointer->DataSectionObject is : 86D98200
FLock!FLockPostOperation: FileObject->SectionObjectPointer->ImageSectionObject is : 00000000
FLock!FLockPostOperation: FileObject->SectionObjectPointer->SharedCacheMap is : 00000000
FLock!FLockPostOperation: FileObject->RelatedFileObject is : 00000000
FLock!FLockPostOperation: FileObject->PrivateCacheMap is : 00000000
<<<=======================


free2o
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 4
    评论
专栏目录
MiniFilter文件系统学习
zhuhuibeishadiao
04-23 1万+
Minfilter与legacy filter区别 比sfilter加载顺序更易控制. altitude被绑定到合适的位置。  Minfilter在注册表服务项中有一项Altitude值 此值越高位置越靠前 (待考证 每一个minifilter驱动必须有一个叫做altitude的唯一标识符.一个minifilter驱动的altitude定义了它加载时在I/O栈中相对其他minifi
Windows驱动_文件系统微小过滤驱动之五MiniFilter例程解析
Z18_28_19的专栏
10-30 7075
今天，上了下看雪，好久没上去了，现在的看雪，跟之前不一样了，刚毕业的那个时候，上面的大牛真是多，现在屈指可数了，可能这些大牛们，因为年纪的增长，已经不在一线了，或许因为家庭，每时间在论坛上逛了，也许都已经在创业了，现在这个APP泛滥的年代，意念和想法，已经不靠技术了，也没有多少人在研究着技术，目前的中国还是有些浮躁，其实好好想想，现在所有的系统，芯片还是掌握在别人手上，不要谈Android,Win
内核文件管理-IRP(一)创建或打开文件
m0_48995611的博客
01-09 942
内核下通过直接向 FSD (File System Driver) 发送 IRP (I/O Request Packet)来管理文件，可以绕过一些 API Hook。 本文讲怎样通过向 FSD 发送 IRP_MJ_CREATE 消息的 IRP 来创建或打开文件(或目录)。 头文件及其他声明或定义 #include <ntifs.h> typedef struct _AUX_ACCESS_DATA { PPRIVILEGE_SET PrivilegesUsed; GENERIC_MAPPIN
FltGetFileNameInformation+VISTA+IRP_MJ_NETWORK_QUERY_OPEN+BSOD
zzh520420的专栏
09-09 962
I'm assuming you're using a minifilter. The most interesting feature of this operation is that one of the parametersis an Irp. This is prett
Windows文件系统过滤管理器之微过滤器驱动开发指南
峥嵘岁月
02-27 9073
Windows文件系统过滤管理器之微过滤器驱动开发指南   0.译者序 对我来说，中文永远是最美，最简洁，最精确和最高雅的文字。 本文翻译仅仅用做交流学习。我不打算保留任何版权或者承担任何责任。不要引用到赢利出版物中给您带来版权官司。本文的翻译者是楚狂人，如果有任何问题，你可以通过邮箱MFC_Tan_Wen@163.com,或者是QQ16191935,或者是MS
notepad++文本编辑器
10-23
6. **节省资源**：Notepad++基于Windows平台的Scintilla组件，占用内存小，启动速度快，对于处理大型文本文件表现优秀。 **二、主要功能** 1. **文本编辑**：支持基本的文本编辑操作，如复制、粘贴、查找替换，...
notepad文本打开工具
03-14
在描述中提到的“文本文档打开工具”，实际上就是指Notepad，它能打开和编辑.txt格式的纯文本文件，同时也支持其他一些编程语言的源代码文件，如HTML、Python、C++等。由于它的简洁，Notepad成为开发者快速查看或...
Notepad++ 打开所有类型文件
08-02
这个软件我用了很多年了，可以说是电脑必备，打开任意类型文件。java，js，html，host，等等各种乱七八糟的。 去新公司工作，工作机上没有notepad，用的很是不舒服，加上之前的安装包找不到了，在网上找了好久才找到...
如何安装Notepad++文本编辑器？
最新发布
12-27
Notepad++ 是一款功能强大且免费的文本编辑器，广泛应用于编程、文本编辑和文档编写等领域。下面将详细介绍如何安装和设置 Notepad++ 文本编辑器。 安装 Notepad++ 1. 下载 Notepad++ 安装文件 首先，需要下载 ...
Notepad++文本编辑器免安装版
12-02
对于多文件项目，Notepad++的多文档界面允许同时打开并编辑多个文件，便于对比或协同工作。 Notepad++采用了Scintilla编辑组件，具有查找和替换的高级功能，支持正则表达式，这对于代码调试和文本处理非常有用。它...
文件系统驱动和设备驱动的区别
04-12
文件系统驱动和设备驱动是容易混淆的概念，本PDF将对文件系统过滤驱动和设备驱动的异同点做简要总结和分析，详细剖析两者的异同点,超高清PDF
内核级文件读写流程
weixin_34307464的博客
11-07 166
在应用层读写文件等操作将通过 INT 2E 切换到内核层。这个不用说大家都很熟悉流程。那么到了内核层又是如何处理的？就先拿 ZwReadFile,ZwWriteFile 说事。首先将文件句柄转换成 FILE_OBJECT 指针。这时 I/OMGR 收到一个 FILE I/O 请求，它将首先选择用 FASTIO 接口来进行缓冲操作（注意：FASTIO 对于 FSD 来说不是必须...
驱动开发坑总结
darthas的专栏
12-26 1118
1. 用FILE_FLAG_OVERLAPPED打开设备时，ReadFile、WriteFile的OVERLAP参数不能为空，否则会异常，到不了驱动的派遣函数 2. 用IoGetDeviceObjectPointer得到FILE_OBJECT和DEVICE_OBJECT指针，用完后Deref文件对象就行了，设备对象千万别Deref，否则会损坏设备对象。他内部是ZwOpenFile再ObRefre
在过滤驱动程序创建IRP查询文件信息
峥嵘岁月
02-04 5712
在开发Windows下文件系统过滤驱动程序时，我们经常需要先查询一下文件的属性信息，为了实现这个小目标，可以调用Windows Native API函数ZwQueryInformationFile并提供希望查询的文件信息类的名字及结构即可。不过如果我们在驱动程序当中自己处理信息查询请求，可以避免IRP重入的问题。1.自己创建文件信息查询IRPNTSTATUSQueryFileInforma
IRP_MJ_SET_INFORMATION
死胖子的博客
03-05 2232
IRP_MJ_SET_INFORMATION 什么时候发送 IO管理器和其他操作系统组件，其他内核模式驱动程序发送 IRP_MJ_SET_INFORMATION 请求。例如当用户模式下的应用程序调用一个像SetEndOfFile 的微软Win32函数，或者是内核模式下的组件调用ZwSetInformationFile时会发送这个请求。 操作：文件系统驱动程序 文件系统驱动程序应当提取和解码
强制删除文件（1）——直接发IRP到文件系统
zz_strive_2012的专栏
10-25 1300
这个程序比较简单，主要练习了两个点： （1）模拟发送IRP （2）使用内核事件对象同步IRP的执行 强制删除文件的思路很简单，把SECTION_OBJECT_POINTERS结构的DataSectionObject和ImageSectionObject两个域清空即可删除正在运行的文件。如果不清空就不能删除运行中的文件。正在运行的文件的这两个域值不为0而文件系统正在根据这两个域决定该文件是
【windows内核驱动开发】文件系统微过滤驱动Minifilter——获取进程信息
zcr214的博客
11-28 2306
【我的】文件系统微过滤驱动Minifilter——获取进程信息 作者：zcr214 时间：2016/4/22   在编写文件系统微过滤驱动minifilter的时候，除了绑定指定的磁盘分卷，对于指定的文件很可能还会有指定的应用程序，例如txt文件可以有很多编辑器可以使用，如wordpad，notepad，sublime，vim，notepad+等，doc文档可以使用office word或W
C/C++ 实现文件透明加解密
热门推荐
尹成的技术博客
11-05 1万+
　　  今日遇见一个开超市的朋友，真没想到在高校开超市一个月可以达到月净利润50K，相比起我们程序员的工资，真是不可同日而语，这个世道啊，真是做程序员不如经商开超市，我们高科技的从业者，真是造原子弹不如卖茶叶蛋。请见代码详细注释   //  修复涉及后视列表的Win2K兼容性//  Fixes Win2K compatibility regarding lookaside
notepad打开文件乱码
04-30
当使用Notepad打开文本文件时出现乱码的情况，可能是由于以下几个原因： 1. 编码格式不匹配：文本文件的编码格式可能与Notepad默认的编码格式（ANSI）不匹配，导致文本文件的内容出现乱码。这时可以尝试用其他编码格式打开文件，如UTF-8等。 2. 文件已经损坏：文本文件可能已经损坏，导致其中的字符出现异常，进而引起乱码。此时需使用文件修复工具进行修复。 3. 文件格式不支持：如果文件格式不是文本格式（例如Word文档），使用Notepad打开就会出现乱码。此时需要使用相应的软件打开该文件。 以上是Notepad打开文件乱码的主要原因和对应的解决方法。需要注意的是，选择合适的编码格式非常重要，不正确的编码格式会导致文本内容出现不可预知的问题，有时更严重的是引起数据损坏。搜索网上有很多转换工具，方便用户修改编码格式。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 4
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值