关于tooflat透明过滤驱动研究（一）.doc

《关于tooflat透明过滤驱动研究（一）.doc》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、关于tooflat透明过滤驱动研究（一）调用规则部分一、规则文件详解xefs.dat的文件长度必须满足下列公式：文件长度%sizeof(RULE)=4这说明文件的长度减4就能够被结构体RULE整除。为什么要多出4呢？我仔细分析了一下程序及文件本身（用UltraEdit），发现文件末尾的最后4个字节存的是前面模式串的数值之和，这一点我在后面逐渐说明。用UltraEdit打开本文中给出的xefs.dat，按16进制查看方式得到如下内容：00000000h:0100000045003A005C0054004500530000000100h:54002A000000000000

2、0000000000000000000200h:0000000000000000000000000000000000000300h:0000000000000000000000000000000000000400h:0000000000000000000000000000000000000500h:0000000000000000000000000000000000000600h:0000000000000000000000000000000000000700h:0000000000000000000000000000000000000800h:000000000000

3、0000000000000000000000000900h:0000000000000000000000000000000000000a00h:0000000000000000000000000000000000000b00h:0000000000000000000000000000000000000c00h:0000000000000000000000000000000000000d00h:0000000000000000000000000000000000000e00h:0000000000000000000000000000000000000f00h:000000

4、0000000000000000000000000000001000h:0000000000000000000000000000000000001100h:0000000000000000000000000000000000001200h:0000000000000000000000000000000000001300h:0000000000000000000000000000000000001400h:0000000000000000000000000000000000001500h:0000000000000000000000000000000000001600h:

5、0000000000000000000000000000000000001700h:0000000000000000000000000000000000001800h:0000000000000000000000000000000000001900h:0000000000000000000000000000000000001a00h:0000000000000000000000000000000000001b00h:0000000000000000000000000000000000001c00h:000000000000000000000000000000000000

6、1d00h:0000000000000000000000000000000000001e00h:0000000000000000000000000000000000001f00h:0000000000000000000000000000000000002000h:0000000000000000000000000000000000002100h:0000000000000000000000000000000000002200h:0000000000000000000000000000000000002300h:000000000000000000000000000000

7、0000002400h:0000000000000000000000000000000000002500h:0000000000000000000000000000000000002600h:0000000000000000000000000000000000002700h:0000000000000000000000000000000000002800h:0000000000000000000000000000000000002900h:0000000000000000000000000000000000002a00h:00000000