0

我目前正试图让我的内核过滤器与我的 c# 应用程序进行通信。内核应用程序在我的结构中发送一个带有文件路径的 UNICODE_STRING。所有其他变量似乎都很好，并且缓冲区位置在用户和内核应用程序中似乎相同，但是当我调用我的 ToString 方法时，我得到了

usermodeFilter.MinifilterWrapper+NativeMethods+COMMAND_MESSAGE

我的 c# 代码看起来像这样

    private NativeMethods.USERCOMMAND_MESSAGE data = new NativeMethods.USERCOMMAND_MESSAGE();

    [SecurityPermission(SecurityAction.Demand)]
    public void FilterGetMessage()
    {

        UInt32 result = NativeMethods.FilterGetMessage(_handle, ref data, (UInt32)Marshal.SizeOf(typeof(NativeMethods.USERCOMMAND_MESSAGE)), IntPtr.Zero);
        if (result == NativeMethods.S_OK)
        {
            Console.WriteLine("message recived");
            Console.WriteLine(this.getProcessNameFromId((int)this.data.cmdMessage.procesID));
            Console.WriteLine(this.data.cmdMessage.ToString());
        }
        else
        {
            throw new InvalidOperationException("Unknown error, number " +result);
        }

    }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        public struct COMMAND_MESSAGE { 
            public UInt32 procesID;
            public UNICODE_STRING fileName;
         } 

        [StructLayout(LayoutKind.Sequential)]
        public struct UNICODE_STRING : IDisposable
        {
            public ushort Length;
            public ushort MaximumLength;
            private IntPtr buffer;

            public UNICODE_STRING(string s)
            {
                Length = (ushort)(s.Length * 2);
                MaximumLength = (ushort)(Length + 2);
                buffer = Marshal.StringToHGlobalUni(s);
            }

            public void Dispose()
            {
                Marshal.FreeHGlobal(buffer);
                buffer = IntPtr.Zero;
            }

            public override string ToString()
            {
                return Marshal.PtrToStringUni(buffer);
            }
          }

C++ 部分代码看起来

            WCHAR parametersKeyBuffer[255];
            gCmdMessageSend.name.Buffer = parametersKeyBuffer;
            gCmdMessageSend.name.MaximumLength = sizeof(parametersKeyBuffer);
            gCmdMessageSend.name.Length = 0;
            RtlCopyUnicodeString(&gCmdMessageSend.name, &fileInfo->Name);
            if (FsClientPort)
                {
                    ulReplayLength = sizeof(gCmdMessageSend);
                    status = FltSendMessage(gFilterHandle, &FsClientPort, &gCmdMessageSend, sizeof(gCmdMessageSend), NULL, &ulReplayLength, &timeout);
                }

顺便说一句，我也获得了对内存位置的无效访问。Marshal.FreeHGlobal(buffer) 时出错；所以我猜我做错了什么

4

1 回答 1

2

Console.WriteLine(this.data.cmdMessage.ToString());

您没有被覆盖的ToString()方法，因此它将默认为类型名称。您还需要覆盖ToString()此类 ( COMMAND_MESSAGE) 中的方法。

于 2013-05-06T15:15:40.193 回答