微过滤器在实现特定操作时需要交换缓冲，例如加密或解密。《Filter Driver Developer Guide》中详细阐述了缓冲交换的规则，包括必须提供后操作回调、确保新缓冲为非分页内存、同步MDL等。微过滤器不应释放旧缓冲或MDL，而在后操作回调中应释放自分配的缓冲。
下面的话摘自《Filter Driver Developer Guide》：
Certain minifilters need to swap the suppliedbuffer for certain operations. Consider a minifilter that implements customencryption. On a non-cached IRP_MJ_READ, it normally wishes to decrypt thecontents of the buffer that was read from the filesystem. Similarly on a write,it wishes to encrypt the contents. Take the latter case: the contents cannot beencrypted in place, because for IRP_MJ_WRITE, the maximal access to the bufferthat the minifilter can assume is IoReadAccess.
Hence the minifilter needs to supplant its ownbuffer which has read/write access, encrypt the contents of the original bufferinto the new one, and send the I/O down.
For this scenario, the Filter Manager supportsbuffer-switching. However there are a few rules to which the minifilter mustadhere:
1. Minifilters that switch a buffer must supply a post-callback. Thisis so that the buffer can be switched back by Filter Manager a
最低0.47元/天 解锁文章
扫一扫
1319
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
