minifilter 双缓存处理完整代码

以下是一个简单的 minifilter 双缓存处理的完整代码：

#include <fltKernel.h>

#define BUFFER_SIZE 1024

PFLT_FILTER g_FilterHandle = NULL;
PFLT_PORT g_ClientPort = NULL;

// 双缓存结构体
typedef struct _CACHE_BUFFER
{
    PVOID DataPtr;
    SIZE_T DataSize;
    BOOLEAN IsDirty;
} CACHE_BUFFER, *PCACHE_BUFFER;

// 缓存对象
CACHE_BUFFER g_CacheBuffer1 = { NULL, 0, FALSE };
CACHE_BUFFER g_CacheBuffer2 = { NULL, 0, FALSE };

// 当前使用的缓存指针
PCACHE_BUFFER g_CurrentCache = &g_CacheBuffer1;
PCACHE_BUFFER g_OtherCache = &g_CacheBuffer2;

// 初始化缓存
NTSTATUS InitializeCache()
{
    NTSTATUS status = STATUS_SUCCESS;
    
    g_CacheBuffer1.DataPtr = ExAllocatePoolWithTag(NonPagedPool, BUFFER_SIZE, 'CB1');
    if (g_CacheBuffer1.DataPtr == NULL)
    {
        status = STATUS_INSUFFICIENT_RESOURCES;
        goto Exit;
    }
    
    g_CacheBuffer2.DataPtr = ExAllocatePoolWithTag(NonPagedPool, BUFFER_SIZE, 'CB2');
    if (g_CacheBuffer2.DataPtr == NULL)
    {
        status = STATUS_INSUFFICIENT_RESOURCES;
        goto Exit;
    }
    
Exit:
    if (!NT_SUCCESS(status))
    {
        if (g_CacheBuffer1.DataPtr != NULL)
        {
            ExFreePool(g_CacheBuffer1.DataPtr);
            g_CacheBuffer1.DataPtr = NULL;
        }
        
        if (g_CacheBuffer2.DataPtr != NULL)
        {
            ExFreePool(g_CacheBuffer2.DataPtr);
            g_CacheBuffer2.DataPtr = NULL;
        }
    }
    
    return status;
}

// 清空缓存
VOID ClearCache(PCACHE_BUFFER Cache)
{
    RtlZeroMemory(Cache->DataPtr, Cache->DataSize);
    Cache->IsDirty = FALSE;
}

// 切换缓存
VOID SwapCache()
{
    PCACHE_BUFFER TempCache = g_CurrentCache;
    g_CurrentCache = g_OtherCache;
    g_OtherCache = TempCache;
}

// 读取缓存数据
NTSTATUS ReadCache(PVOID Buffer, ULONG Length, PLARGE_INTEGER Offset, PULONG BytesRead)
{
    NTSTATUS status = STATUS_SUCCESS;
    ULONG BytesToCopy;
    
    // 如果缓存数据已经包含了请求的数据，则直接从缓存中读取
    if (Offset->QuadPart >= 0 && Offset->QuadPart + Length <= g_CurrentCache->DataSize)
    {
        BytesToCopy = Length;
        RtlCopyMemory(Buffer, (PUCHAR)g_CurrentCache->DataPtr + Offset->QuadPart, BytesToCopy);
        *BytesRead = BytesToCopy;
        goto Exit;
    }
    
    // 如果缓存数据不包含请求的数据，则将未保存的缓存数据写入磁盘，并清空缓存
    if (g_CurrentCache->IsDirty)
    {
        // TODO: 写入磁盘
        ClearCache(g_CurrentCache);
    }
    
    // 从磁盘读取数据并填充到当前缓存中
    // TODO: 读取磁盘数据
    g_CurrentCache->DataSize = BUFFER_SIZE;
    
    // 复制请求的数据到输出缓存
    BytesToCopy = min(Length, g_CurrentCache->DataSize - Offset->QuadPart);
    RtlCopyMemory(Buffer, (PUCHAR)g_CurrentCache->DataPtr + Offset->QuadPart, BytesToCopy);
    *BytesRead = BytesToCopy;
    
Exit:
    return status;
}

// 写入缓存数据
NTSTATUS WriteCache(PVOID Buffer, ULONG Length, PLARGE_INTEGER Offset, PULONG BytesWritten)
{
    NTSTATUS status = STATUS_SUCCESS;
    ULONG BytesToCopy;
    
    // 如果缓存数据已经包含了请求的数据，则直接在缓存中写入
    if (Offset->QuadPart >= 0 && Offset->QuadPart + Length <= g_CurrentCache->DataSize)
    {
        BytesToCopy = Length;
        RtlCopyMemory((PUCHAR)g_CurrentCache->DataPtr + Offset->QuadPart, Buffer, BytesToCopy);
        g_CurrentCache->IsDirty = TRUE;
        *BytesWritten = BytesToCopy;
        goto Exit;
    }
    
    // 如果缓存数据不包含请求的数据，则将未保存的缓存数据写入磁盘，并清空缓存
    if (g_CurrentCache->IsDirty)
    {
        // TODO: 写入磁盘
        ClearCache(g_CurrentCache);
    }
    
    // 从磁盘读取数据并填充到当前缓存中
    // TODO: 读取磁盘数据
    g_CurrentCache->DataSize = BUFFER_SIZE;
    
    // 写入请求的数据到输出缓存
    BytesToCopy = min(Length, g_CurrentCache->DataSize - Offset->QuadPart);
    RtlCopyMemory((PUCHAR)g_CurrentCache->DataPtr + Offset->QuadPart, Buffer, BytesToCopy);
    g_CurrentCache->IsDirty = TRUE;
    *BytesWritten = BytesToCopy;
    
Exit:
    return status;
}

// 通信消息处理函数
NTSTATUS MessageCallback(PVOID ConnectionCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength)
{
    NTSTATUS status = STATUS_SUCCESS;
    ULONG BytesReturned = 0;
    
    // 解析命令
    switch (*(PULONG)InputBuffer)
    {
    case 0: // 读取数据
        {
            PVOID Buffer = (PUCHAR)OutputBuffer + sizeof(ULONG);
            ULONG Length = OutputBufferLength - sizeof(ULONG);
            PLARGE_INTEGER Offset = (PLARGE_INTEGER)((PUCHAR)InputBuffer + sizeof(ULONG));
            status = ReadCache(Buffer, Length, Offset, &BytesReturned);
            if (NT_SUCCESS(status))
            {
                *(PULONG)OutputBuffer = BytesReturned;
                *ReturnOutputBufferLength = BytesReturned + sizeof(ULONG);
            }
        }
        break;
        
    case 1: // 写入数据
        {
            PVOID Buffer = (PUCHAR)InputBuffer + sizeof(ULONG) + sizeof(LARGE_INTEGER);
            ULONG Length = InputBufferLength - sizeof(ULONG) - sizeof(LARGE_INTEGER);
            PLARGE_INTEGER Offset = (PLARGE_INTEGER)((PUCHAR)InputBuffer + sizeof(ULONG));
            status = WriteCache(Buffer, Length, Offset, &BytesReturned);
            if (NT_SUCCESS(status))
            {
                *(PULONG)OutputBuffer = BytesReturned;
                *ReturnOutputBufferLength = sizeof(ULONG);
            }
        }
        break;
        
    default:
        status = STATUS_INVALID_PARAMETER;
        break;
    }
    
    return status;
}

// 卸载过滤器回调函数
VOID UnloadCallback(PFLT_FILTER Filter)
{
    if (g_ClientPort != NULL)
    {
        FltCloseCommunicationPort(g_ClientPort);
        g_ClientPort = NULL;
    }
    
    if (g_CacheBuffer1.DataPtr != NULL)
    {
        ExFreePool(g_CacheBuffer1.DataPtr);
        g_CacheBuffer1.DataPtr = NULL;
    }
    
    if (g_CacheBuffer2.DataPtr != NULL)
    {
        ExFreePool(g_CacheBuffer2.DataPtr);
        g_CacheBuffer2.DataPtr = NULL;
    }
}

// 驱动程序入口点
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    NTSTATUS status = STATUS_SUCCESS;
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING PortName;
    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
    
    // 初始化双缓存
    status = InitializeCache();
    if (!NT_SUCCESS(status))
    {
        goto Exit;
    }
    
    // 创建通信端口
    RtlInitUnicodeString(&PortName, L"\\MiniFilterPort");
    InitializeObjectAttributes(&ObjectAttributes, &PortName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, SecurityDescriptor);
    status = FltCreateCommunicationPort(g_FilterHandle, &g_ClientPort, &ObjectAttributes, NULL, MessageCallback, NULL, NULL, 1);
    if (!NT_SUCCESS(status))
    {
        goto Exit;
    }
    
    // 注册文件系统过滤器
    status = FltRegisterFilter(DriverObject, &FilterRegistration, &g_FilterHandle);
    if (!NT_SUCCESS(status))
    {
        goto Exit;
    }
    
    // 设置卸载回调函数
    DriverObject->DriverUnload = UnloadCallback;
    
Exit:
    if (SecurityDescriptor != NULL)
    {
        FltFreeSecurityDescriptor(SecurityDescriptor);
    }
    
    if (!NT_SUCCESS(status))
    {
        if (g_ClientPort != NULL)
        {
            FltCloseCommunicationPort(g_ClientPort);
            g_ClientPort = NULL;
        }
        
        if (g_CacheBuffer1.DataPtr != NULL)
        {
            ExFreePool(g_CacheBuffer1.DataPtr);
            g_CacheBuffer1.DataPtr = NULL;
        }
        
        if (g_CacheBuffer2.DataPtr != NULL)
        {
            ExFreePool(g_CacheBuffer2.DataPtr);
            g_CacheBuffer2.DataPtr = NULL;
        }
    }
    
    return status;
}

该代码中定义了双缓存结构体 CACHE_BUFFER 和两个缓存对象 g_CacheBuffer1 和 g_CacheBuffer2。其中 g_CurrentCache 指向当前使用的缓存，g_OtherCache 指向另一个缓存。在读取或写入数据时，先判断当前缓存是否包含要读取或写入的数据，如果包含，则直接在缓存中读取或写入；否则，将未保存的缓存数据写入磁盘，并清空缓存，然后从磁盘读取数据并填充到当前缓存中。在写入数据时，还需要设置当前缓存为“脏缓存”，表示缓存中的数据已经被修改过，需要在后面的操作中写入到磁盘中。通信消息处理函数 MessageCallback 用来接收客户端发送的读取或写入数据的请求，并调用相应的读取或写入函数。在卸载过滤器时，需要关闭通信端口并释放缓存。