0

我正在使用 C# 开发 USB 监视器，我希望能够在系统驱动程序处理到达并启用到达设备后做出反应，但比应用程序级进程（资源管理器）更快。我想检查 autorun.inf 的设备，如果发现拒绝到达。我使用了 MSDN 上描述的 BROADCAST_QUERY_DENY 但没有成功。这是代码（假设 USB 作为“I”驱动器到达）：

        switch (msg.Msg)
        {
            case Win32CODES.WM_DEVICECHANGE:
            {
                if (msg.LParam != IntPtr.Zero)
                {
                    DEV_BROADCAST_HDR pHdr = (DEV_BROADCAST_HDR)Marshal.PtrToStructure(msg.LParam, typeof(DEV_BROADCAST_HDR));

                    switch ((int)msg.WParam)
                    {
                        case Win32CODES.DBT_DEVICEARRIVAL:
                        {
                            if (pHdr.dbch_devicetype == Win32CODES.DBT_DEVTYP_VOLUME)
                            {
                                DEV_BROADCAST_VOLUME pVol = (DEV_BROADCAST_VOLUME)Marshal.PtrToStructure(msg.LParam, typeof(DEV_BROADCAST_VOLUME));

                                Char c = GetDriveLetter(pVol.dbcv_unitmask);

                                if (c == 'I')
                                {
                                    msg.Result = new IntPtr(Win32CODES.BROADCAST_QUERY_DENY );

                                    base.WndProc(ref msg);

                                    return;
                                }



                            }

                            break;
                        }
                    }
                }
                break;
            }
        }
        base.WndProc(ref msg);
    }

然后我尝试了另一种方法，但再次没有成功。

     switch (msg.Msg)
        {
            case Win32CODES.WM_DEVICECHANGE:
            {
                if (msg.LParam != IntPtr.Zero)
                {
                    DEV_BROADCAST_HDR pHdr = (DEV_BROADCAST_HDR)Marshal.PtrToStructure(msg.LParam, typeof(DEV_BROADCAST_HDR));

                    switch ((int)msg.WParam)
                    {
                        case Win32CODES.DBT_DEVICEARRIVAL:
                        {
                            if (pHdr.dbch_devicetype == Win32CODES.DBT_DEVTYP_VOLUME)
                            {
                                DEV_BROADCAST_VOLUME pVol = (DEV_BROADCAST_VOLUME)Marshal.PtrToStructure(msg.LParam, typeof(DEV_BROADCAST_VOLUME));

                                Char c = GetDriveLetter(pVol.dbcv_unitmask);

                                if (c == 'I')
                                {
                                    int bytesReturned = 0;

                                    IntPtr buffer = Marshal.AllocHGlobal(sizeof(int));

                                    SafeFileHandle _hdev = CreateFileR(c.ToString());

                                    bool result = DeviceIoControl(_hdev, CTL_CODE(0x00000033, 0x0400, 0, 1),
                                        IntPtr.Zero, 0, buffer, sizeof(int),
                                        out bytesReturned, IntPtr.Zero);

                                    int sessionId = Marshal.ReadInt32(buffer);

                                    Marshal.FreeHGlobal(buffer);
                                }



                            }

                            break;
                        }
                    }
                }
                break;
            }
        }
        base.WndProc(ref msg);

有没有办法做到这一点？谢谢..

4

0 回答 0