如何捕获读写系统调用？
每当我尝试在随身碟上写入任何内容时，都会生成写入系统调用。我想要做的是，这个写调用应该被捕获，并且应该要求用户输入预先确定的密码（我可以在编码过程中定义）。 请告诉我这是否可能？如果是的话我应该怎么做？
Whenever i attempt to write anything on my pendrive, a write system call is generated. What i want to do is, this write call should be trapped and and the user should be requested to input predecided password( which i can define during coding itself).
Please tell me whether this is possible or not? and if yes than how should i do it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Windows DDK 有一个在
filesys\minifilter中挂钩文件读取/写入/复制的示例，其中包含操作前和操作后回调，这应该让您为内核方面进行设置。对于 GUI 部分，您需要执行非阻塞旋转，直到驱动器发出事件信号，您可能还需要管道或映射内存视图来传递数据The windows DDK has an example of hooking the file reads/writes/copies in
filesys\minifilter, with both pre and post op callbacks, that should have you set for the kernel side of things. For the gui part you'll need something to do a non-blocking spin till the drives signals an event, you'll probably also want a pipe or mapped memory view to pass data aroundEasyHook 应该使您能够挂钩内核函数。我还没有尝试过，所以你的里程可能会有所不同。请务必谨慎挂钩函数 - 您可能会将机器的性能降低到无法使用的程度。您想要的是与用户交互，这意味着您必须搁置挂钩函数，并向用户空间发出回调。这可能不适合凡人。
无论如何，祝你好运！
EasyHook is supposed to give you the ability to hook kernel functions. I have not tried it, so your mileage may vary. Be sure to hook functions cautiously - you may degrade the performance of your machine to a point where it's unusable. What you want is to interact with the user, meaning that you must put the hooked function on hold, and issue a callback into user space. This is probably not an exercise for mere mortals.
At any rate, good luck!