1

ReadFile に問題があり、重複しています。

まず、ReadFile を 0 と重ねて使用します

ZeroMemory(&overlapped ,sizeof(OVERLAPPED));

hDevice = CreateFileW(zwpath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL);

if(hDevice != INVALID_HANDLE_VALUE){

ret = ReadFile(hDevice, buff, 1024, &numerobyte, &overlapped);

}

for() を使用すると、printf() を使用してバイトを確認できます

 for (int n=0; n<sizeof(buff); n++)  
       {  
           printf("0x%02X ", buff[n]);  
       }

そして今、私は多数のバリアントを1つ持っています

crbig = 322122547

    d1 = (DWORD*)crbig;
    overlapped.Offset = d1[1]; //22122547
    overlapped.OffsetHigh = d1[0];// 00000003

ReafFile を 2 回使用する必要があります。この 2 回目は、offset 値と highoffset 値を指定して Overlapped() を使用しています。

    d1 = (DWORD*)&crbig;
overlapped.Offset = d1[1];
overlapped.OffsetHigh = d1[0];

ret = ReadFile(hDevice, buff, 1024, &numerobyte, &overlapped);

しかし、 for() は最初の ReadFile をスローするのと同じバイトを出力します。 memset() でバッファーをクリーニングするか、別のバッファーを使用してみましたが、常に同じバイトが表示されます

おそらく Overlapped() はどこに行くべきかを ReadFile に指示し、1024 バイトを読み取り、それをバッファに保存しますが、何も起こりません。バッファには、overlapped() = 0 と同じ最初のバイトがあります。

これは完全なコードです

int main(int argc, char *argv[]){

    HANDLE hDevice;
    OVERLAPPED overlapped;
    DWORD crbig;
    BYTE buff[1024] = {0};
    DWORD numerobyte = 0, nbytes = 0;
    UINT32 ret;
    DWORD *d1;
    int offset1 = 11, offset2 = 13, offset3 = 30;
    long MFTCluster = 0, bytespercluster = 0, sectperclusters = 0, offet = 0;
    unsigned long mult = 0;

    ZeroMemory(&overlapped ,sizeof(OVERLAPPED));

    hDevice = CreateFileW(zwpath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL);

    if(hDevice != INVALID_HANDLE_VALUE){

        ret = ReadFile(hDevice, buff, 1024, &numerobyte, &overlapped);

    }else
    {
        return NULL;
    }

    if(ret == 0){


        ret = WaitForSingleObject(hDevice,INFINITE );

        switch (ret)
        {
        case WAIT_OBJECT_0:break;
        case WAIT_TIMEOUT:break;
        default:
            break;
        }
    }
    else
    {
        return NULL;
    }


    if((int)buff[3] == 'N' && (int)buff[4] == 'T' && (int)buff[5] == 'F' && (int)buff[6] == 'S' ){
        printf("Volumen es formato NTFS\n\n\n");
    }

    bytespercluster = endianhextodec(buff, offset1);
    sectperclusters = endianhextodec(buff, offset2);
    MFTCluster = endianhextodec(buff, offset3);

    crbig = (sectperclusters * (bytespercluster * MFTCluster));

    d1 = (DWORD*)&crbig;
    overlapped.Offset = d1[1];
    overlapped.OffsetHigh = d1[0];

    ret = ReadFile(hDevice, buff, 1024, &numerobyte, &overlapped);

    if(ret == 0){


        ret = WaitForSingleObject(hDevice,INFINITE );

        switch (ret)
        {
        case WAIT_OBJECT_0:break;
        default:
            break;
        }
    }
    else
    {
        return NULL;
    }

    for (int n=0; n<sizeof(buff); n++)  
    {  
        printf("0x%02X ", buff[n]);  
    } 

    CloseHandle(hDevice);

    getchar();
}

VB.NET

Private Sub SetReadFileOffset(ByRef NO As System.Threading.NativeOverlapped, ByRef curBig As Int64)

        Dim lowoffset() As Byte = BitConverter.GetBytes(curBig)
        Dim highoffset As Int32 = BitConverter.ToInt32(lowoffset, 0)
        Dim high As Int32
        Dim lastbytes(3) As Byte
        Array.Copy(lowoffset, 4, lastbytes, 0, 4)
        high = BitConverter.ToInt32(lastbytes, 0)
        NO.OffsetLow = highoffset
        NO.OffsetHigh = high
    End Sub

 SetReadFileOffset(NO, MFTCluster * SectperCluster * BytesPerSect)
        ret = ReadFile(Hnd, Buffer, 1024, nRead, NO)
        If ret = 0 Then
            ret = WaitForSingleObject(Hnd, INFINITE)
            Select Case ret
                Case WAIT_OBJECT_0
                Case Else
            End Select
        Else
            Return Nothing
        End If
4

0 に答える 0