FileMon中的Hash表算法代码

     这个hash表算法，不是很复杂。不过对于学习还是不错的选择。现在把代码贴下：

 

    这里定义了每个hash项的结构，以及hash桶的计算。

 

// // Structure for the fileobject/name hash table // typedef struct _nameentry { PFILE_OBJECT FileObject; struct _nameentry *Next; CHAR FullPathName[]; } HASH_ENTRY, *PHASH_ENTRY; // // Number of hash buckets in the hash table // #define NUMHASH 0x100 // // Hash function. Basically chops the low few bits of the file object // #if defined(_IA64_) #define HASHOBJECT(_fileobject) (((ULONG_PTR)_fileobject)>>5)%NUMHASH #else #define HASHOBJECT(_fileobject) (((ULONG)_fileobject)>>5)%NUMHASH #endif

 

下面这部分为hash清空，删除的代码。

 //---------------------------------------------------------------------- // H A S H T A B L E M A N A G E M E N T //---------------------------------------------------------------------- //---------------------------------------------------------------------- // // FilemonHashCleanup // // Called when we are unloading to free any memory that we have // in our possession. // //---------------------------------------------------------------------- VOID FilemonHashCleanup( VOID ) { PHASH_ENTRY hashEntry, nextEntry; ULONG i; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); // // Free the hash table entries // for( i = 0; i < NUMHASH; i++ ) { hashEntry = HashTable[i]; while( hashEntry ) { nextEntry = hashEntry->Next; ExFreePool( hashEntry ); hashEntry = nextEntry; } HashTable[i] = NULL; } ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); } //---------------------------------------------------------------------- // // FilemonFreeHashEntry // // When we see a file close, we can free the string we had associated // with the fileobject being closed since we know it won't be used // again. // //---------------------------------------------------------------------- VOID FilemonFreeHashEntry( PFILE_OBJECT fileObject ) { PHASH_ENTRY hashEntry, prevEntry; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); // // Look-up the entry // hashEntry = HashTable[ HASHOBJECT( fileObject ) ]; prevEntry = NULL; while( hashEntry && hashEntry->FileObject != fileObject ) { prevEntry = hashEntry; hashEntry = hashEntry->Next; } // // If we fall of the hash list without finding what we're looking // for, just return. // if( !hashEntry ) { ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); return; } // // Got it! Remove it from the list // if( prevEntry ) { prevEntry->Next = hashEntry->Next; } else { HashTable[ HASHOBJECT( fileObject )] = hashEntry->Next; } // // Free the entry's memory // ExFreePool( hashEntry ); ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); }

 

 

下面这段代码是在函数中向hash表添加项的过程。大致的意思就是首先找到桶的位置，然后在这个桶下的列表中添加就行了。

 

 

PHASH_ENTRY hashEntry, newEntry; // // Allocate a hash entry // newEntry = ExAllocatePool( NonPagedPool, sizeof(HASH_ENTRY ) + strlen( fullPathName ) + 1); // // If no memory for a new entry, oh well. // if( newEntry ) { // // Fill in the new entry // newEntry->FileObject = fileObject; strcpy( newEntry->FullPathName, fullPathName ); // // Put it in the hash table // KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite( &HashResource, TRUE ); newEntry->Next = HashTable[ HASHOBJECT(fileObject) ]; HashTable[ HASHOBJECT(fileObject) ] = newEntry; ExReleaseResourceLite( &HashResource ); KeLeaveCriticalRegion(); }

 

下面是hash表的定义，以及初始化过程：

 

// // Hash table for keeping names around. This is necessary because // at any time the name information in the fileobjects that we // see can be deallocated and reused. If we want to print accurate // names, we need to keep them around ourselves. // PHASH_ENTRY HashTable[NUMHASH]; // // Initialize the name hash table // for(i = 0; i < NUMHASH; i++ ) HashTable[i] = NULL;