FltRegisterFilter在filter.obj函数DriverEntry中的引用
FltRegisterFilter在filter.obj函数DriverEntry中的引用
提问于 2022-06-05 02:18:52
基本上，我正在尝试创建一个简单的FileSystem MiniFilter驱动程序，在该驱动程序中，我可以通过编写修改记事本文件。遵循这个教程。所以我在visual中创建了一个项目，它是Filter Driver: NDIS类型的。以下是完整的代码：
/*++
Module Name:
Filter.c
Abstract:
Sample NDIS Lightweight filter driver
--*/
#include "precomp.h"
PFLT_FILTER FilterHandle = NULL;
NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags);
FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext, FLT_POST_OPERATION_FLAGS flags);
FLT_PREOP_CALLBACK_STATUS MiniPreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
FLT_PREOP_CALLBACK_STATUS MiniPreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext);
const FLT_OPERATION_REGISTRATION Callbacks[] = {
{IRP_MJ_CREATE,0,MiniPreCreate,MiniPostCreate},
{IRP_MJ_WRITE,0,MiniPreCreate,NULL},
{IRP_MJ_OPERATION_END}
};
const FLT_REGISTRATION FilterRegistration = {
sizeof(FLT_REGISTRATION),
FLT_REGISTRATION_VERSION,
0,
NULL,
Callbacks,
MiniUnload,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL
};
NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
KdPrint(("driver unload \r\n"));
FltUnregisterFilter(FilterHandle);
return STATUS_SUCCESS;
}
FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext, FLT_POST_OPERATION_FLAGS flags) {
KdPrint(("Post Create is running \r\n"));
return FLT_POSTOP_FINISHED_PROCESSING;
}
FLT_PREOP_CALLBACK_STATUS MiniPreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
PFLT_FILE_NAME_INFORMATION FileNameInfo;
NTSTATUS status;
WCHAR Name[300] = { 0 };
status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &FileNameInfo);
if (NT_SUCCESS(status)) {
status = FltParseFileNameInformation(FileNameInfo);
if (NT_SUCCESS(status)) {
if (FileNameInfo->Name.MaximumLength < 260) {
RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
KdPrint(("CreateFile: %ws \r\n", Name));
}
}
FltReleaseFileNameInformation(FileNameInfo);
}
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
FLT_PREOP_CALLBACK_STATUS MiniPreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) {
PFLT_FILE_NAME_INFORMATION FileNameInfo;
NTSTATUS status;
WCHAR Name[300] = { 0 };
status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &FileNameInfo);
if (NT_SUCCESS(status)) {
status = FltParseFileNameInformation(FileNameInfo);
if (NT_SUCCESS(status)) {
if (FileNameInfo->Name.MaximumLength < 260) {
RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
_wcsupr(Name);
if (wcsstr(Name, L"OPENME.TXT") != NULL) {
KdPrint(("Write File: %ws Blocked \r\n", Name));
Data->IoStatus.Status = STATUS_INVALID_PARAMETER;
Data->IoStatus.Information = 0;
FltReleaseFileNameInformation(FileNameInfo);
return FLT_PREOP_COMPLETE;
}
KdPrint(("CreateFile: %ws \r\n", Name));
}
}
FltReleaseFileNameInformation(FileNameInfo);
}
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
NTSTATUS status;
status = FltRegisterFilter(DriverObject, &FilterRegistration, &FilterHandle);
if (NT_SUCCESS(status)) {
status = FltStartFiltering(FilterHandle);
if (!NT_SUCCESS(status)) {
FltUnregisterFilter(FilterHandle);
}
}
return status;
}头文件已进入precomp.h，如下所示：
#pragma warning(disable:4201) //nonstandard extension used : nameless struct/union
#pragma warning(disable:4100)
#include <fltKernel.h>
#include <dontuse.h>
#include <suppress.h>
#include <ndis.h>
#include <filteruser.h>
#include <ntddk.h>
#include "flt_dbg.h"
#include "filter.h"其他一切都是默认的。
属性下的项目配置是活动的(X64)。
有了所有这些，我得到了下面的错误：
Severity Code Description Project File Line Suppression State
Error LNK2019 unresolved external symbol FltGetFileNameInformation referenced in function MiniPreCreate default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Warning 1324 [Version] section should specify PnpLockdown=1 to prevent external apps from modifying installed driver files. default C:\Users\Abdul\source\repos\default\default\default.inf 8
Error LNK2019 unresolved external symbol FltRegisterFilter referenced in function DriverEntry default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Error LNK2019 unresolved external symbol FltUnregisterFilter referenced in function MiniUnload default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Error LNK2019 unresolved external symbol FltStartFiltering referenced in function DriverEntry default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Error LNK2019 unresolved external symbol FltReleaseFileNameInformation referenced in function MiniPreCreate default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Error LNK2019 unresolved external symbol FltParseFileNameInformation referenced in function MiniPreCreate default C:\Users\Abdul\source\repos\default\default\filter.obj 1
Error LNK2001 unresolved external symbol FilterDriverHandle default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK2001 unresolved external symbol FilterDriverObject default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK2001 unresolved external symbol NdisFilterDeviceHandle default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK2001 unresolved external symbol NdisDeviceObject default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK2001 unresolved external symbol FilterListLock default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK2001 unresolved external symbol FilterModuleList default C:\Users\Abdul\source\repos\default\default\device.obj 1
Error LNK1120 12 unresolved externals default C:\Users\Abdul\source\repos\default\x64\Debug\default.sys 1 有人能指点我做错了什么吗？
回答 1
Stack Overflow用户
发布于 2022-07-03 09:40:04
我遇到了同样的问题。对我来说，问题是迷你过滤器模板没有显示在新项目的模板列表中，所以我不得不从头开始创建它，我不可避免地遗漏了一些东西。在对照Microsoft (检查这里)提供的小型项目时，反复检查链接器选项后，我意识到fltMgr.lib必须专门提供给链接器。为了做到这一点，右键单击“解决方案资源管理器”左窗格中的项目。然后去Properties->Linker->Input->Additional Dependencies。将$(DDK_LIB_PATH)\fltMgr.lib添加到附加依赖项列表中，并重新构建项目！我希望这能为您做到这一点，但是正如微软文档所指出的，LNK2019可能是由您的配置中的许多其他问题引起的。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/72504346
复制相关文章
相似问题
腾讯云开发者
