问题描述

过滤驱动禁止U盘读写（非注册表）

张帆的《Windows 驱动开发技术详解》中有一个U盘过滤驱动，实现U盘的只读锁定。我想在某种情况下实现U盘的读写锁定。因为我想做一个密码的判断，所以不可能手动对注册表修改来实现这个功能。运行实例代码是好的。但是我加了一个对读操作请求的处理，然后Windows7 32bit测试机立刻蓝屏。代码如下：

 NTSTATUS
USBSCSICompletion( IN PDEVICE_OBJECT DeviceObject,
                   IN PIRP Irp,
                   IN PVOID Context )
{
    PDEVICE_EXTENSION pdx = ( PDEVICE_EXTENSION )
                                   DeviceObject->DeviceExtension;

    IoAcquireRemoveLock(&pdx->RemoveLock,Irp);

    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp );

    PSCSI_REQUEST_BLOCK CurSrb=irpStack->Parameters.Scsi.Srb;
    PCDB cdb = (PCDB)CurSrb->Cdb;
    UCHAR opCode=cdb->CDB6GENERIC.OperationCode; 

    if(opCode==SCSIOP_MODE_SENSE  && CurSrb->DataBuffer
        && CurSrb->DataTransferLength >=
        sizeof(MODE_PARAMETER_HEADER))
    {
        KdPrint(("SCSIOP_MODE_SENSE comming!n"));

        PMODE_PARAMETER_HEADER modeData = (PMODE_PARAMETER_HEADER)CurSrb->DataBuffer;

        modeData->DeviceSpecificParameter |= MODE_DSP_WRITE_PROTECT;
    } 

    if (opCode == SCSIOP_READ)
    {
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
    }

    if ( Irp->PendingReturned )
    {
        IoMarkIrpPending( Irp );
    } 

    IoReleaseRemoveLock(&pdx->RemoveLock,Irp);

    return Irp->IoStatus.Status ;
}

蓝屏log

 PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 0007e861, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

貌似是写锁定和 读锁定两个的方法冲突了。

还请大神指点指点！谢谢！