/////By?Fanxiushu?2014-10-31
#include?“common.h“

//通過盤符查詢設備名//////

NTSTATUS?getSymboliclinkobject（const?wchar_t*?SymName?PUNICODE_STRING?ObjName）
{
	NTSTATUS?status;
	WCHAR?Tmp[4];
	PWCHAR?buf?=?NULL;
	HANDLE?h;
	UNICODE_STRING?us;
	ULONG?length?=?0;
	RtlInitUnicodeString（&us?SymName）;
	object_ATTRIBUTES?oa;
	///
	ObjName->MaximumLength?=?ObjName->Length?=?0;?ObjName->Buffer?=?NULL;

	InitializeobjectAttributes（&oa?&us?OBJ_KERNEL_HANDLE?0?NULL）;
	status?=?ZwOpenSymboliclinkobject（&h?GENERIC_READ?&oa）;
	if?（!NT_SUCCESS（status））{
		DPT（“ZwOpenSymboliclinkobject?Err=0x%X\n“?status?）;
		return?status;
	}
	us.MaximumLength?=?4;
	us.Buffer?=?Tmp;?
	us.Length?=?0;
	status?=?ZwQuerySymboliclinkobject（h?&us?&length）;
	if?（status?!=?STATUS_BUFFER_TOO_SMALL）{?//不是尺寸不合適的錯誤，就認為是錯誤
		ZwClose（h）;
		DPT（“ZwQuerySymboliclinkobject?Err=0x%X\n“?status?）;
		return?STATUS_UNSUCCESSFUL;
	}

	buf?=?（PWCHAR）ExAllocatePoolWithTag（NonPagedPool?length?+?sizeof（WCHAR）?‘FXSD‘）;
	if?（!buf）{
		ZwClose（h）;
		return?STATUS_INSUFFICIENT_RESOURCES;
	}
	ObjName->MaximumLength?=?（USHORT）length?+?sizeof（WCHAR）;
	ObjName->Length?=?0;
	ObjName->Buffer?=?buf;
	status?=?ZwQuerySymboliclinkobject（h?ObjName?&length）;

	ZwClose（h）;

	if?（!NT_SUCCESS（status））{
		///
		if?（buf）ExFreePool（buf）;
		ObjName->MaximumLength?=?ObjName->Length?=?0;?ObjName->Buffer?=?NULL;
		return?status;
	}

	buf[length?/?sizeof（WCHAR）]?=?L‘\0‘;
	////
	return?status;
}

static?FORCEINLINE?BOOLEAN
MatchDirectory（PUNICODE_STRING?Name?PUNICODE_STRING?DirPUNICODE_STRING?OutDir）
{
	ULONG?cnt2?=?Dir->Length?/?sizeof（WCHAR）;
	ULONG?cnt1?=?Name->Length?/?sizeof（WCHAR）;
	
	if?（cnt2?>?cnt1）?return?FALSE;?//全部路徑都不夠監(jiān)控目錄長

	if?（_wcsnicmp（Dir->Buffer?Name->Buffer?cnt2）?==?0）{?//匹配上了
		ULONG?cnt?=?cnt1?-?cnt2;
		PWCHAR?buf?=?L“\\“;
		if?（cnt?==?0）{?//
			//			DPT（“**?ALL?Match!!.\n“）;
			//
			cnt?=?1;?////
		}
		else{
			buf?=?&Name->Buffer[cnt2];
			if?（*buf?!=?L‘\\‘）{
				if?（cnt2?Buffer[cnt2?-?1]?!=?L‘\\‘）?return?FALSE;
				buf?=?&Name->Buffer[cnt2?-?1];
				cnt?+=?1;
			}
			/////
		}
		/////
		PWCHAR?b?=?（PWCHAR）ExAllocatePoolWithTag（PagedPool?（cnt?+?1）*sizeof（WCHAR）?‘FXSD‘）;
		if?（!b）return?FALSE;
		RtlCopyMemory（b?buf?cnt*sizeof（WCHAR））;
		b[cnt]?=?L‘\0‘;
		OutDir->Length?=?（USHORT）cnt*sizeof（WCHAR）;
		OutDir->MaximumLength?=?（（USHORT）cnt?+?1）*sizeof（WCHAR）;
		OutDir->Buffer?=?b;
		////
		return?TRUE;
	}
	////
	return?FALSE;
}
//根據(jù)?FILE_object?的FileName判斷這個對象是否在某個目錄下?只在?IRP_MJ_CREATE?及創(chuàng)建之前有效
BOOLEAN?IsFileObjNameInDirectory（PFILE_object?fileObj?PUNICODE_STRING?Dir?PUNICODE_STRING?OutDir?）
{
	if?（fileObj->FileName.Length?==?0?||?!fileObj->FileName.Buffer）?return?FALSE;

	PUNICODE_STRING?Name?=?&fileObj->FileName;
	ULONG?cnt2?=?Dir->Length?/?sizeof（WCHAR）;
	ULONG?cnt1?=?Name->Length?/?sizeof（WCHAR）;
	if?（!Name->Buffer?||?Name->Length?==?0）{
		DPT（“**?FILE_object->FileName?Empty.\

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件??????40736??2013-07-19?23:57??bin\InstDrv.exe

?????文件?????121856??2015-01-19?20:42??bin\xFsRedir.exe

?????文件??????33280??2015-01-21?21:57??bin\xfs_redir.sys

?????文件???????5314??2014-12-16?13:47??driver\buildchk_win7_amd64.log

?????文件????????339??2015-01-19?23:13??driver\buildchk_win7_x86.log

?????文件????????341??2015-01-20?17:25??driver\buildfre_win7_amd64.log

?????文件???????3665??2015-01-21?21:57??driver\buildfre_win7_x86.log

?????文件???????6237??2015-01-12?10:51??driver\common.cpp

?????文件???????1787??2014-12-04?23:02??driver\common.h

?????文件??????23397??2015-01-21?21:44??driver\fastio.cpp

?????文件??????24094??2015-01-19?22:39??driver\fs_filter.cpp

?????文件???????4928??2015-01-17?01:37??driver\fs_filter.h

?????文件??????24308??2015-01-11?00:36??driver\fs_info.cpp

?????文件??????14691??2015-01-19?23:12??driver\fs_notify.cpp

?????文件??????22930??2015-01-18?05:15??driver\ioctl.cpp

?????文件???????3754??2015-01-05?16:01??driver\ioctl.h

?????文件???????2704??2015-01-19?22:24??driver\main.cpp

?????文件????????267??2002-03-25?19:38??driver\makefile

?????文件???????9140??2013-03-26?04:34??driver\rbtree.c

?????文件???????4364??2013-03-26?04:37??driver\rbtree.h

?????文件????????345??2015-01-15?21:21??driver\sources

?????文件??????17872??2015-01-20?17:22??driver\xfs_redir.cpp

?????文件???????5026??2015-01-20?17:18??driver\xfs_redir.h

????.CA....????527360??2015-01-21?21:57??driver\xfs_redir.pdb

?????文件??????33280??2015-01-21?21:57??driver\xfs_redir.sys

?????文件???????1548??2015-01-19?11:23??user\resource.h

?????文件??????21955??2015-01-19?01:33??user\src\fsdev.cpp

?????文件???????4269??2015-01-19?01:30??user\src\fsdev.h

?????文件??????16718??2015-01-19?12:09??user\src\fsftp.cpp

?????文件??????20061??2015-01-14?00:19??user\src\ftpclient.cpp

............此處省略20個文件信息