在内核模式下读取文件
我正在构建一个驱动程序，我想读取一些文件。 有没有办法使用“ZwReadFile()”或类似的函数来读取 逐行查看文件的内容，以便我可以循环处理它们。
MSDN 中的文档指出：- ZwReadFile 开始从给定的 ByteOffset 或当前文件位置读取到给定的缓冲区。它在下列条件之一下终止读取操作：
- 由于已读取 Length 参数指定的字节数，因此缓冲区已满。因此，在没有溢出的情况下，不能将更多数据放入缓冲区。
- 在读取操作期间到达文件末尾，因此文件中没有更多数据要传输到缓冲区中。
谢谢。
I am building a driver and i want to read some files.
Is there any way to use "ZwReadFile()" or a similar function to read the
contents of the files line by line so that i can process them in a loop.
The documentation in MSDN states that :-
ZwReadFile begins reading from the given ByteOffset or the current file position into the given Buffer. It terminates the read operation under one of the following conditions:
- The buffer is full because the number of bytes specified by the Length parameter has been read. Therefore, no more data can be placed into the buffer without an overflow.
- The end of file is reached during the read operation, so there is no more data in the file to be transferred into the buffer.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，没有。您必须创建一个包装器才能实现您想要的。
但是，鉴于内核模式代码有可能导致系统崩溃而不是其运行的进程崩溃，您必须确保诸如用户模式中已知的长行等问题不会导致问题。
如果数据量（并且将保持）低于注册表值可以保存的阈值，则您应该使用它。特别是
REG_MULTI_SZ，它具有您正在寻找的属性（“逐行”数据存储）。No, there is not. You'll have to create a wrapper to achieve what you want.
However, given that kernel mode code has the potential to crash the system rather than the process it runs in, you have to make sure that problems such as those known from usermode with very long lines etc will not cause issues.
If the amount of data is (and will stay) below the threshold of what registry values can hold, you should use that instead. In particular
REG_MULTI_SZwhich has the properties you are looking for ("line-wise" storage of data).在这种情况下，除非性能至关重要（例如“实时”），否则我会将过滤传递给用户模式服务或应用程序。将文件名发送给应用程序进行处理。用户模式应用程序更容易测试和调试。它也不会蓝屏或挂起您的盒子。
In this situation unless performance is a critical (like 'realtime') then I would pass the filtering to a user mode service or application. Send the file name to the application to process. A user mode application is easier to test and easier to debug. It wont blue screen or hang your box either.