当前位置：首页 > news >正文

FltSendMessage 超时时间相关问题

news 来源：原创 2024/9/19 13:33:14

之前做基于minifilter的windows文件过滤驱动时，会碰到fltsendmessage超时问题，查阅资料后特此记录下

NTSTATUS FLTAPI FltSendMessage([in]            PFLT_FILTER    Filter,[in]            PFLT_PORT      *ClientPort,[in]            PVOID          SenderBuffer,[in]            ULONG          SenderBufferLength,[out, optional] PVOID          ReplyBuffer,[in, out]       PULONG         ReplyLength,[in, optional]  PLARGE_INTEGER Timeout
);

[in, optional] Timeout

A pointer to a timeout value that specifies the total absolute or relative length of time, in units of 100 nanoseconds, for which the caller can be put into a wait state until the message is received by the user-mode application and until it receives a reply (if one is expected).

A positive value specifies an absolute time, relative to January 1, 1601. A negative value specifies an interval relative to the current time. Set to NULL if the caller can be put into a wait state indefinitely.

FltSendMessage sends a message to a user-mode application on behalf of a minifilter driver or a minifilter driver instance.

If the application calls FilterGetMessage to get the message before the minifilter driver calls FltSendMessage to send it, the message is delivered immediately. This is typically the case when the application calls FilterGetMessage from inside a message loop.

Otherwise, if an application has not called to get a message, the minifilter driver is put into a wait state as follows:

If Timeout is nonzero and the application calls FilterGetMessage before the Timeout interval expires, the message is delivered.
If Timeout is nonzero and the application doesn't call FilterGetMessage before the Timeout interval expires, the message is not delivered, and FltSendMessage returns STATUS_TIMEOUT. (Note: STATUS_TIMEOUT is a success code.)
If Timeout is zero, the minifilter driver is put into a wait state indefinitely. When the application calls FilterGetMessage, the message is delivered.

After the message is delivered, if ReplyBuffer is NULL, FltSendMessage returns STATUS_SUCCESS.

Otherwise, if ReplyBuffer is not NULL, the minifilter driver is put into a wait state as follows:

If Timeout is nonzero and the application calls FilterReplyMessage before the Timeout interval expires, the minifilter driver receives the reply, and FltSendMessage returns STATUS_SUCCESS.
If Timeout is nonzero and the minifilter driver does not receive a reply before the Timeout interval expires, FltSendMessage returns STATUS_TIMEOUT. (Note: STATUS_TIMEOUT is a success code.)
If Timeout is zero when the minifilter driver is waiting for the reply, the minifilter driver is put into a wait state indefinitely. When the application calls FilterReplyMessage, the minifilter driver receives the reply, and FltSendMessage returns STATUS_SUCCESS.