王
王府井
Unregistered / Unconfirmed
GUEST, unregistred user!
你知道很多人强烈要求取消吗?LINUX现在已经不稳定了,他们认为这会更加增加不稳定性,而且HTTP服务器(静态文本)的瓶颈在于带宽。
//========================================
多少年强烈要求取消?LINUX现在已经不稳定了?就因为这个不稳定?
比如:3721为什么总是杀不掉,就是使用了文件过滤引擎在自我保护。
//========================================
能讲讲3721和cnnic在文件保护方面的各自的实现吗?
不好意思,3721的源代码我刚好有一份,代码在这里我贴一部分(因为保密协议我只能帖部分代码)。
///////////////////////////////////////////////////////////////////
// 文件名 : Kfilter.cpp/Kfilter.h
///////////////////////////////////////////////////////////////////
// 功 能 : Filter入口及初始化
///////////////////////////////////////////////////////////////////
// 重要性级别:-X-X-X-X-X-
// 文件重要性:Kfilter基本组成文件,不允许修改/删除
////////////////////////////////////////////////////////////////
// 最新版本 : 1.01
// 版本历史 : 1.00,1.01
////////////////////////////////////////////////////////////////
// 重 大 修 改 历 史
////////////////////////////////////////////////////////////////
// 修改者 : vcmfc
// 修改日期 : 2003-04-24
// 修改内容 : 直接内置规则锁
////////////////////////////////////////////////////////////////
extern "C"
{
#include <ntifs.h>
}
#include "Kfilter.h"
#include "KfCheckOption.h"
#include "KfFastIo.h" //Fast IO函数
#include "KfCommonFunc.h" //公共常用函数
#if WINVER >= 0x0501
#include "KfSupportxp.h"
#endif
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
#include "KfStaticLoad.h"
#endif
#include "KfUser.h"
//////////////////////////////////////////////////////////////////////////////////////
//全局变量 - Kfilter所必需的
///////////////////////////////////////////////////////////////////////////////////////
// 注意:请不要修改或删除
////////////////////////////////////////////////////////////
PDRIVER_OBJECT g_KfilterDriverObject = NULL; //我们自身驱动对象
PDEVICE_OBJECT g_pControlDevObj = NULL; //我们自身设备对象
WCHAR g_RegistryPath[200] = {0}; //系统注册表项
NTSTATUS g_KfilterStatus = STATUS_SUCCESS; //配置信息是否成功装入
FAST_MUTEX g_AttachLock; //Attach到file system访问锁
ULONG g_nProcessNameOffset; //进程名的偏移量
WCHAR g_WindowDirectory[100] = {0}; //当前Windows目录
ERESOURCE g_FilterRuleLock; //规则表数据访问共享锁
ERESOURCE g_FilterDiskLock; //磁盘过滤表数据访问共享锁
//Support Windows XP
#if WINVER >= 0x0501
extern KF_DYNAMIC_FUNCTION_POINTERS g_DynamicFunctions;
extern ULONG g_OsMajorVersion;
extern ULONG g_OsMinorVersion;
#endif
/////////////////////////////////////////////////////////////////
// 函数类型:接口函数
////////////////////////////////////////////////////////////////
// 功能:驱动入口函数
/////////////////////////////////////////////////////////////////
// 注意:业务逻辑初始化不要放在这里
/////////////////////////////////////////////////////////////////
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
KdPrint(("KfilterriverEntry is Entry./n");
KdPrint(("KfilterriverObject=0x%4x,RegistryPath=%wZ/n", DriverObject, RegistryPath));
//保存全局数据
g_KfilterDriverObject = DriverObject;
RtlCopyMemory(g_RegistryPath, RegistryPath->Buffer, RegistryPath->Length);
NTSTATUS status = STATUS_SUCCESS;
//取得进程偏移量
g_nProcessNameOffset = KfGetProcessNameOffset();
if(g_nProcessNameOffset == 0)
{
KdPrint(("Kfilter: Cann't get Process Name Offset./n");
return STATUS_UNSUCCESSFUL;
}
#if WINVER >= 0x0501
//
// Try to load the dynamic functions that may be available for our use.
//
KfLoadDynamicFunctions();
//
// Now get the current OS version that we will use to determine what logic
// paths to take when this driver is built to run on various OS version.
//
KfGetCurrentVersion();
#endif
//创建设备对象
UNICODE_STRING DeviceName;
RtlInitUnicodeString(&DeviceName, DEVICE_NAME);
status = IoCreateDevice(DriverObject,
0,
&DeviceName,
FILE_DEVICE_DISK_FILE_SYSTEM,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&g_pControlDevObj);
if(!NT_SUCCESS(status))
{
KdPrint(("Kfilter: Create Kfilter Device is Error:0x%x/n", status));
return status;
}
//创建链接符号
UNICODE_STRING LinkName;
RtlInitUnicodeString(&LinkName, SYMBOL_LINK_NAME);
status = IoCreateSymbolicLink(&LinkName, &DeviceName);
if(!NT_SUCCESS(status))
{
KdPrint(("Kfilter: Create Kfilter Symbolic Link:%ws is Error:0x%x/n", SYMBOL_LINK_NAME, status));
IoDeleteDevice(g_pControlDevObj);
return status;
}
//设置分派函数
DriverObject->DriverUnload = KfDriverUnload;
for(int i=0; i<=IRP_MJ_MAXIMUM_FUNCTION; ++i)
{
DriverObject->MajorFunction = KfPassThrough;
}
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KfDeviceIoControl;
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = KfFileSystemControl;
#endif
DriverObject->MajorFunction[IRP_MJ_CREATE] = KfCreate;
DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = KfSetInformation;
DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = KfDirectoryControl;
DriverObject->MajorFunction[IRP_MJ_READ] = KfRead;
DriverObject->MajorFunction[IRP_MJ_WRITE] = KfWrite;
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = KfCleanup;
DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = KfQueryInformation;
//初始化FastIo回调函数
PFAST_IO_DISPATCH fastIoDispatch = (PFAST_IO_DISPATCH)ExAllocatePool(NonPagedPool, sizeof(FAST_IO_DISPATCH));
if(!fastIoDispatch)
{
KdPrint(("KfilterriverEntry: Allocate NonPagePool memory is fail./n");
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice(g_pControlDevObj);
return STATUS_INSUFFICIENT_RESOURCES;
}
RtlZeroMemory(fastIoDispatch, sizeof(FAST_IO_DISPATCH) );
fastIoDispatch->SizeOfFastIoDispatch = sizeof( FAST_IO_DISPATCH );
fastIoDispatch->FastIoCheckIfPossible = KfFastIoCheckIfPossible;
fastIoDispatch->FastIoRead = KfFastIoRead;
fastIoDispatch->FastIoWrite = KfFastIoWrite;
fastIoDispatch->FastIoQueryBasicInfo = KfFastIoQueryBasicInfo;
fastIoDispatch->FastIoQueryStandardInfo = KfFastIoQueryStandardInfo;
fastIoDispatch->FastIoLock = KfFastIoLock;
fastIoDispatch->FastIoUnlockSingle = KfFastIoUnlockSingle;
fastIoDispatch->FastIoUnlockAll = KfFastIoUnlockAll;
fastIoDispatch->FastIoUnlockAllByKey = KfFastIoUnlockAllByKey;
fastIoDispatch->FastIoDeviceControl = KfFastIoDeviceControl;
fastIoDispatch->FastIoDetachDevice = KfFastIoDetachDevice;
// new for NT 4.0
fastIoDispatch->FastIoQueryNetworkOpenInfo = KfFastIoQueryNetworkOpenInfo;
fastIoDispatch->MdlRead = KfFastIoMdlRead;
fastIoDispatch->MdlReadComplete = KfFastIoMdlReadComplete;
fastIoDispatch->PrepareMdlWrite = KfFastIoPrepareMdlWrite;
fastIoDispatch->MdlWriteComplete = KfFastIoMdlWriteComplete;
fastIoDispatch->FastIoReadCompressed = KfFastIoReadCompressed;
fastIoDispatch->FastIoWriteCompressed = KfFastIoWriteCompressed;
fastIoDispatch->MdlReadCompleteCompressed = KfFastIoMdlReadCompleteCompressed;
fastIoDispatch->MdlWriteCompleteCompressed = KfFastIoMdlWriteCompleteCompressed;
fastIoDispatch->FastIoQueryOpen = KfFastIoQueryOpen;
//保存FastIo分派表
DriverObject->FastIoDispatch = fastIoDispatch;
#if WINVER >= 0x0501
{
FS_FILTER_CALLBACKS fsFilterCallbacks;
if (IS_WINDOWSXP_OR_LATER()) {
ASSERT( NULL != g_DynamicFunctions.RegisterFileSystemFilterCallbacks );
//
// This version of the OS exports FsRtlRegisterFileSystemFilterCallbacks,
// therefore it must support the FsFilter callbacks interface. We
// will register to receive callbacks for these operations.
//
// Setup the callbacks for the operations we receive through
// the FsFilter interface.
//
fsFilterCallbacks.SizeOfFsFilterCallbacks = sizeof( FS_FILTER_CALLBACKS );
fsFilterCallbacks.PreAcquireForSectionSynchronization = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForSectionSynchronization = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForSectionSynchronization = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForSectionSynchronization = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForCcFlush = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForCcFlush = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForCcFlush = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForCcFlush = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForModifiedPageWriter = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForModifiedPageWriter = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForModifiedPageWriter = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForModifiedPageWriter = KfPostFsFilterPassThrough;
status = (g_DynamicFunctions.RegisterFileSystemFilterCallbacks)( DriverObject, &fsFilterCallbacks );
if (!NT_SUCCESS( status )) {
KdPrint(("KfilterriverEntry: RegisterFileSystemFilterCallbacks is fail,status=0x%4x/n", status));
DriverObject->FastIoDispatch = NULL;
ExFreePool( fastIoDispatch );
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice( g_pControlDevObj );
return status;
}
}
}
#endif
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
status = IoRegisterFsRegistrationChange( DriverObject, KfFsdNotification);
if (!NT_SUCCESS( status )) {
KdPrint(( "DriverEntry: Error registering FS change notification, status=%08x/n", status ));
DriverObject->FastIoDispatch = NULL;
ExFreePool(fastIoDispatch);
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice(g_pControlDevObj);
return status;
}
#endif
ExInitializeFastMutex( &g_AttachLock );
ExInitializeResourceLite( &g_FilterRuleLock );
ExInitializeResourceLite( &g_FilterDiskLock );
//调用用户初始全局变量
KfUserInitGlobalVariant(DriverObject);
//初始重新初始化
IoRegisterDriverReinitialization(DriverObject, KfInitKfilter, NULL);
g_pControlDevObj->Flags &= ~DO_DEVICE_INITIALIZING;
KdPrint(("KfilterriverEntry is End./n");
return STATUS_SUCCESS;
}
//========================================
多少年强烈要求取消?LINUX现在已经不稳定了?就因为这个不稳定?
比如:3721为什么总是杀不掉,就是使用了文件过滤引擎在自我保护。
//========================================
能讲讲3721和cnnic在文件保护方面的各自的实现吗?
不好意思,3721的源代码我刚好有一份,代码在这里我贴一部分(因为保密协议我只能帖部分代码)。
///////////////////////////////////////////////////////////////////
// 文件名 : Kfilter.cpp/Kfilter.h
///////////////////////////////////////////////////////////////////
// 功 能 : Filter入口及初始化
///////////////////////////////////////////////////////////////////
// 重要性级别:-X-X-X-X-X-
// 文件重要性:Kfilter基本组成文件,不允许修改/删除
////////////////////////////////////////////////////////////////
// 最新版本 : 1.01
// 版本历史 : 1.00,1.01
////////////////////////////////////////////////////////////////
// 重 大 修 改 历 史
////////////////////////////////////////////////////////////////
// 修改者 : vcmfc
// 修改日期 : 2003-04-24
// 修改内容 : 直接内置规则锁
////////////////////////////////////////////////////////////////
extern "C"
{
#include <ntifs.h>
}
#include "Kfilter.h"
#include "KfCheckOption.h"
#include "KfFastIo.h" //Fast IO函数
#include "KfCommonFunc.h" //公共常用函数
#if WINVER >= 0x0501
#include "KfSupportxp.h"
#endif
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
#include "KfStaticLoad.h"
#endif
#include "KfUser.h"
//////////////////////////////////////////////////////////////////////////////////////
//全局变量 - Kfilter所必需的
///////////////////////////////////////////////////////////////////////////////////////
// 注意:请不要修改或删除
////////////////////////////////////////////////////////////
PDRIVER_OBJECT g_KfilterDriverObject = NULL; //我们自身驱动对象
PDEVICE_OBJECT g_pControlDevObj = NULL; //我们自身设备对象
WCHAR g_RegistryPath[200] = {0}; //系统注册表项
NTSTATUS g_KfilterStatus = STATUS_SUCCESS; //配置信息是否成功装入
FAST_MUTEX g_AttachLock; //Attach到file system访问锁
ULONG g_nProcessNameOffset; //进程名的偏移量
WCHAR g_WindowDirectory[100] = {0}; //当前Windows目录
ERESOURCE g_FilterRuleLock; //规则表数据访问共享锁
ERESOURCE g_FilterDiskLock; //磁盘过滤表数据访问共享锁
//Support Windows XP
#if WINVER >= 0x0501
extern KF_DYNAMIC_FUNCTION_POINTERS g_DynamicFunctions;
extern ULONG g_OsMajorVersion;
extern ULONG g_OsMinorVersion;
#endif
/////////////////////////////////////////////////////////////////
// 函数类型:接口函数
////////////////////////////////////////////////////////////////
// 功能:驱动入口函数
/////////////////////////////////////////////////////////////////
// 注意:业务逻辑初始化不要放在这里
/////////////////////////////////////////////////////////////////
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
KdPrint(("KfilterriverEntry is Entry./n");
KdPrint(("KfilterriverObject=0x%4x,RegistryPath=%wZ/n", DriverObject, RegistryPath));
//保存全局数据
g_KfilterDriverObject = DriverObject;
RtlCopyMemory(g_RegistryPath, RegistryPath->Buffer, RegistryPath->Length);
NTSTATUS status = STATUS_SUCCESS;
//取得进程偏移量
g_nProcessNameOffset = KfGetProcessNameOffset();
if(g_nProcessNameOffset == 0)
{
KdPrint(("Kfilter: Cann't get Process Name Offset./n");
return STATUS_UNSUCCESSFUL;
}
#if WINVER >= 0x0501
//
// Try to load the dynamic functions that may be available for our use.
//
KfLoadDynamicFunctions();
//
// Now get the current OS version that we will use to determine what logic
// paths to take when this driver is built to run on various OS version.
//
KfGetCurrentVersion();
#endif
//创建设备对象
UNICODE_STRING DeviceName;
RtlInitUnicodeString(&DeviceName, DEVICE_NAME);
status = IoCreateDevice(DriverObject,
0,
&DeviceName,
FILE_DEVICE_DISK_FILE_SYSTEM,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&g_pControlDevObj);
if(!NT_SUCCESS(status))
{
KdPrint(("Kfilter: Create Kfilter Device is Error:0x%x/n", status));
return status;
}
//创建链接符号
UNICODE_STRING LinkName;
RtlInitUnicodeString(&LinkName, SYMBOL_LINK_NAME);
status = IoCreateSymbolicLink(&LinkName, &DeviceName);
if(!NT_SUCCESS(status))
{
KdPrint(("Kfilter: Create Kfilter Symbolic Link:%ws is Error:0x%x/n", SYMBOL_LINK_NAME, status));
IoDeleteDevice(g_pControlDevObj);
return status;
}
//设置分派函数
DriverObject->DriverUnload = KfDriverUnload;
for(int i=0; i<=IRP_MJ_MAXIMUM_FUNCTION; ++i)
{
DriverObject->MajorFunction = KfPassThrough;
}
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KfDeviceIoControl;
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = KfFileSystemControl;
#endif
DriverObject->MajorFunction[IRP_MJ_CREATE] = KfCreate;
DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = KfSetInformation;
DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = KfDirectoryControl;
DriverObject->MajorFunction[IRP_MJ_READ] = KfRead;
DriverObject->MajorFunction[IRP_MJ_WRITE] = KfWrite;
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = KfCleanup;
DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = KfQueryInformation;
//初始化FastIo回调函数
PFAST_IO_DISPATCH fastIoDispatch = (PFAST_IO_DISPATCH)ExAllocatePool(NonPagedPool, sizeof(FAST_IO_DISPATCH));
if(!fastIoDispatch)
{
KdPrint(("KfilterriverEntry: Allocate NonPagePool memory is fail./n");
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice(g_pControlDevObj);
return STATUS_INSUFFICIENT_RESOURCES;
}
RtlZeroMemory(fastIoDispatch, sizeof(FAST_IO_DISPATCH) );
fastIoDispatch->SizeOfFastIoDispatch = sizeof( FAST_IO_DISPATCH );
fastIoDispatch->FastIoCheckIfPossible = KfFastIoCheckIfPossible;
fastIoDispatch->FastIoRead = KfFastIoRead;
fastIoDispatch->FastIoWrite = KfFastIoWrite;
fastIoDispatch->FastIoQueryBasicInfo = KfFastIoQueryBasicInfo;
fastIoDispatch->FastIoQueryStandardInfo = KfFastIoQueryStandardInfo;
fastIoDispatch->FastIoLock = KfFastIoLock;
fastIoDispatch->FastIoUnlockSingle = KfFastIoUnlockSingle;
fastIoDispatch->FastIoUnlockAll = KfFastIoUnlockAll;
fastIoDispatch->FastIoUnlockAllByKey = KfFastIoUnlockAllByKey;
fastIoDispatch->FastIoDeviceControl = KfFastIoDeviceControl;
fastIoDispatch->FastIoDetachDevice = KfFastIoDetachDevice;
// new for NT 4.0
fastIoDispatch->FastIoQueryNetworkOpenInfo = KfFastIoQueryNetworkOpenInfo;
fastIoDispatch->MdlRead = KfFastIoMdlRead;
fastIoDispatch->MdlReadComplete = KfFastIoMdlReadComplete;
fastIoDispatch->PrepareMdlWrite = KfFastIoPrepareMdlWrite;
fastIoDispatch->MdlWriteComplete = KfFastIoMdlWriteComplete;
fastIoDispatch->FastIoReadCompressed = KfFastIoReadCompressed;
fastIoDispatch->FastIoWriteCompressed = KfFastIoWriteCompressed;
fastIoDispatch->MdlReadCompleteCompressed = KfFastIoMdlReadCompleteCompressed;
fastIoDispatch->MdlWriteCompleteCompressed = KfFastIoMdlWriteCompleteCompressed;
fastIoDispatch->FastIoQueryOpen = KfFastIoQueryOpen;
//保存FastIo分派表
DriverObject->FastIoDispatch = fastIoDispatch;
#if WINVER >= 0x0501
{
FS_FILTER_CALLBACKS fsFilterCallbacks;
if (IS_WINDOWSXP_OR_LATER()) {
ASSERT( NULL != g_DynamicFunctions.RegisterFileSystemFilterCallbacks );
//
// This version of the OS exports FsRtlRegisterFileSystemFilterCallbacks,
// therefore it must support the FsFilter callbacks interface. We
// will register to receive callbacks for these operations.
//
// Setup the callbacks for the operations we receive through
// the FsFilter interface.
//
fsFilterCallbacks.SizeOfFsFilterCallbacks = sizeof( FS_FILTER_CALLBACKS );
fsFilterCallbacks.PreAcquireForSectionSynchronization = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForSectionSynchronization = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForSectionSynchronization = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForSectionSynchronization = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForCcFlush = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForCcFlush = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForCcFlush = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForCcFlush = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForModifiedPageWriter = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForModifiedPageWriter = KfPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForModifiedPageWriter = KfPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForModifiedPageWriter = KfPostFsFilterPassThrough;
status = (g_DynamicFunctions.RegisterFileSystemFilterCallbacks)( DriverObject, &fsFilterCallbacks );
if (!NT_SUCCESS( status )) {
KdPrint(("KfilterriverEntry: RegisterFileSystemFilterCallbacks is fail,status=0x%4x/n", status));
DriverObject->FastIoDispatch = NULL;
ExFreePool( fastIoDispatch );
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice( g_pControlDevObj );
return status;
}
}
}
#endif
#ifdef KFILTER_SUPPORT_STATIC_LOAD //support static load
status = IoRegisterFsRegistrationChange( DriverObject, KfFsdNotification);
if (!NT_SUCCESS( status )) {
KdPrint(( "DriverEntry: Error registering FS change notification, status=%08x/n", status ));
DriverObject->FastIoDispatch = NULL;
ExFreePool(fastIoDispatch);
IoDeleteSymbolicLink(&LinkName);
IoDeleteDevice(g_pControlDevObj);
return status;
}
#endif
ExInitializeFastMutex( &g_AttachLock );
ExInitializeResourceLite( &g_FilterRuleLock );
ExInitializeResourceLite( &g_FilterDiskLock );
//调用用户初始全局变量
KfUserInitGlobalVariant(DriverObject);
//初始重新初始化
IoRegisterDriverReinitialization(DriverObject, KfInitKfilter, NULL);
g_pControlDevObj->Flags &= ~DO_DEVICE_INITIALIZING;
KdPrint(("KfilterriverEntry is End./n");
return STATUS_SUCCESS;
}