sfilter.inf 修改

基于sfilter改的过滤驱动,想把它改个名称。结果就BSOD了。


做了如下修改:

1、把sfilter的地方都修改为processmon.(注意LoadOrderGroup   = "FSFilter  Activity Monitor"  ,这里的FSFilter不是sfilter)。

2、修改了provider和时间等信息。


结果发现直接蓝屏了,挨个试了一下。发现只要把这几个地方改为sfilter就好了

CatalogFile     = Processmon.cat    ----> sfilter.cat


[SourceDisksFiles]
Processmon.sys = 1  -------->sfilter.sys = 1

ServiceBinary    = %12%\Processmon.sys      -----> = %12%\sfilter.sys

[ProcessMon.DriverFiles]
Processmon.sys         -------->sfilter.sys


目前无解,求解。

尝试了修改class名称和GUID,都没影响。


修改的源inf文件如下:

;;;
;;; Sfilter
;;;
;;;
;;; Copyright (c) 2000, Microsoft Corporation
;;;

[Version]
signature      = "$Windows NT$"
Class        = "ActivityMonitor"                ;This is determined by the work this filter driver does
ClassGuid     = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}    ;This value is determined by the Class
Provider     = %pgl%
DriverVer     = 12/27/2011,1.0.0.1
CatalogFile     = Processmon.cat                                   ; A CatalogFile entry is required for a WHQL signature.
                                                                ; The actual catalog file will be provided by WHQL.  The
                                                                ; catalog file for this sample is not provided for use.
[DestinationDirs]
DefaultDestDir             = 12
ProcessMon.DriverFiles      = 12             ;%windir%\system32\drivers

[SourceDisksNames]
1 = %Disk1%

[SourceDisksFiles]
Processmon.sys = 1

;;
;; Default install sections
;;

[DefaultInstall]
OptionDesc          = %ProcessMonServiceDesc%
CopyFiles           = ProcessMon.DriverFiles

[DefaultInstall.Services]
AddService          = %ProcessMonServiceName%,,ProcessMon.Service
AddReg              = ProcessMon.AddRegistry

;;
;; Default uninstall sections
;;

[DefaultUninstall]
DelFiles   = ProcessMon.DriverFiles
DelReg     = ProcessMon.DelRegistry

[DefaultUninstall.Services]
DelService = ProcessMon,0x200        ; Flags note to stop service first

;
; Services Section
;

[ProcessMon.Service]
DisplayName      = %ProcessMonServiceName%
Description      = %ProcessMonServiceDesc%
ServiceBinary    = %12%\Processmon.sys        ;%windir%\system32\drivers\ProcessMon.sys
ServiceType      = 2                    ;SERVICE_FILE_SYSTEM_DRIVER
StartType        = 0                    ;SERVICE_BOOT_START
ErrorControl     = 1                    ;SERVICE_ERROR_NORMAL
LoadOrderGroup   = "FSFilter  Activity Monitor"
AddReg             = ProcessMon.AddRegistry

;
; Registry Modifications
;

[ProcessMon.AddRegistry]
HKLM,%ProcessMonRegistry%,%ProcessMonDebugFlags%,0x00010001 ,0

[ProcessMon.DelRegistry]
HKLM,%ProcessMonRegistry%,%ProcessMonDebugFlags%

;
; Copy Files
;

[ProcessMon.DriverFiles]
Processmon.sys

;;
;; String Section
;;

[Strings]
pgl                = "Pangolin"
ProcessMonServiceDesc  = "ProcessMon Filter Driver"
ProcessMonServiceName  = "ProcessMon"
ProcessMonRegistry     = "system\currentcontrolset\services\ProcessMon"
ProcessMonDebugFlags   = "DebugFlags"
Disk1               = "ProcessMon Source Media"



评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值