CN111367707B - Bad disk access management method and system - Google Patents
Bad disk access management method and system Download PDFInfo
- Publication number
- CN111367707B CN111367707B CN202010457882.XA CN202010457882A CN111367707B CN 111367707 B CN111367707 B CN 111367707B CN 202010457882 A CN202010457882 A CN 202010457882A CN 111367707 B CN111367707 B CN 111367707B
- Authority
- CN
- China
- Prior art keywords
- disk
- filter driver
- disk filter
- event
- pdiskno
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0793—Remedial or corrective actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0727—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a storage system, e.g. in a DASD or network based storage system
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Stored Programmes (AREA)
Abstract
The invention relates to the technical field of data storage, in particular to a bad disk access management method and system. The access management method for the bad disk comprises the steps that an application program and a disk filter driver are initialized, when a new disk is accessed, the disk filter driver writes a disk number of the new disk into a pDiskNo, a hNotifyEvent event is set, the application program prompts a user to select a disk processing mode after receiving the hNotifyEvent event, and sets a pDiskNo event and an hAppRespond event according to the selection of the user, and the disk filter driver intercepts or does not intercept the reading and writing of the new disk according to the pDiskNo event and the hAppRespond event, so that after the system accesses the new disk with possibly bad sectors, recovery software has an opportunity to access the data of the new disk for recovery operation, and the phenomenon that a windows bottom layer driver is blocked or other system abnormal conditions are caused is avoided.
Description
Technical Field
The invention relates to the technical field of data storage, in particular to a bad disk access management method and system.
Background
The initialization sequence of the storage driver when Windows is started is as follows: 1. enumerating a bus to a Disk, creating Disk equipment, and calling Disk Driver; 2. the PartMgr Driver generates partition equipment according to the disk partition table; 3. the Volmgr Driver generates volume equipment according to the partition dependency relationship and generates a corresponding file system object for each volume; 4. the application program can access the file on the disk through CreateFile, ReadFile and WriteFile.
When a file system object is generated, the file system reads data of a volume to determine whether the data is in a supported data format or not, necessary file system parameter objects are initialized, if the data of the volume is illegal, the file system cannot be normally identified and initialized, serious abnormality which may cause the identification and initialization process of the file system can occur, the whole operating system is stuck or crashed (windows blue screen) due to the fact that the processing enters dead cycle or memory damage, the whole system cannot be normally used, software cannot be normally used, and data recovery software cannot normally work when the system cannot be normally used.
The data exception of the volume is mostly due to the fact that the read data is not correct due to the fact that physical bad sectors exist on a magnetic disk. As long as the file system is prevented from reading the volume data, the file system does not recognize the data, and the initialization process of the file system cannot be entered, and the volume cannot be loaded.
Disclosure of Invention
In view of the above, the present application provides a method and a system for managing access to a bad disk, which can solve or at least partially solve the above existing problems.
In order to solve the above technical problems, the technical solution provided by the present invention is a bad disk access management method applied to an application program and a disk filter driver, the method including:
s11: the application program creates two global event objects hNotifyEvent and hAppRespond, allocates a memory position pDiskNo for storing a disk number, transmits the hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver and waits for the hNotifyEvent event;
s12: the disk filter driver receives hNotifyEvent, hAppRespond and pDiskNo transmitted by an application program;
s13: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo, sets a hNotifyEvent event to inform an application program that the new disk is accessed, and waits for an hAppRespond event;
s14: after receiving the hNotifyEven event, the application program prompts a user to select a disk processing mode and sets a pDiskNo event notification disk filter driver and an hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
s15: and the disk filter driver receives the happpRespond event and decides to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
Preferably, the method of S11 includes:
s111: an application program creates two global event objects hNotifyEvent and hAppRespond through a CreateEvent function and allocates a memory position pDiskNo for storing a disk number;
s112: the application program transmits hNotifyEvent, hAppRespond and pDiskNo to the disk filter driver through a DeviceIOControl function;
s113: the application calls the waitforsingleibject function to wait for the hNotifyEvent event notification of the disk filter driver.
Preferably, the method of S13 includes:
s131: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
s132: the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
s133: the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
Preferably, the method of S14 includes:
after receiving the hNotifyEven event, the application program prompts the user to select a disk processing mode: intercepting reading and writing or not intercepting reading and writing;
if the information of intercepting reading and writing is received, the pDiskNo is unchanged, and an happRespond event is set through a SetEvent function to inform a disk filter driver;
and if the information of not intercepting the read-write is received, setting pDiskNo to a preset value, and setting an happRespond event through a SetEvent function to inform a disk filter driver.
Preferably, the method of S15 includes:
receiving the happpRespond event by the disk filter driver;
and the disk filter driver judges whether the pDiskNo is consistent with the disk number of the currently accessed new disk, if so, intercepts the read-write of the new disk, forbids system access, and if not, does not intercept the read-write of the new disk and allows the system access.
Preferably, the access management method for a bad disk further includes S10: installing a disk filter driver and an application program; the method for installing the disk filter drive in S10 includes:
s101: copying the disk filter driver installation file to c under windows 32 drivers;
s102: and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
Preferably, the process of executing driverlentry in the disk filter drive installation file by the system in S102 includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
The invention also provides a bad disk access management system, which comprises an application program module and a disk filter driving module, wherein the application program module runs on an application layer of the system, the disk filter driving module runs on a kernel layer of the system, and the application program module comprises:
an application program initialization unit, which is used for creating two global event objects hNotifyEvent and hAppRespond, allocating a memory position pDiskNo for storing a disk number, transmitting the hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver and waiting for the hNotifyEvent event;
the application program execution unit is used for prompting a user to select a disk processing mode after receiving the hNotifyEven event and setting a pDiskNo event and an hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
the disk filter driver module includes:
the disk filter driver initialization unit is used for the disk filter driver to receive hNotifyEvent, hAppRespond and pDiskNo transmitted by the application program;
the disk filter driver monitoring unit is used for writing a disk number of a new disk into pDiskNo when the routine function AddDevice is called, setting a hNotifyEvent event to inform an application program that the new disk is accessed, and waiting for an hAppRespond event;
and the disk filter drive execution unit is used for receiving the happpRespond event and determining to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
Preferably, the working method of the application program initialization unit includes:
creating two global event objects hNotifyEvent and hAppRespond through a CreateEvent function, and allocating a memory position pDiskNo for storing a disk number;
transmitting hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver through a DeviceIOControl function;
calling the waitfonsileobject function waits for the hNotifyEvent event notification of the disk filter driver.
Preferably, the operation method of the disk filter drive monitoring unit includes:
when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
Preferably, the working method of the application program execution unit includes:
after receiving the hNotifyEven event, the application program prompts the user to select a disk processing mode: intercepting reading and writing or not intercepting reading and writing;
if the information of intercepting reading and writing is received, the pDiskNo is unchanged, and an happRespond event is set through a SetEvent function to inform a disk filter driver;
and if the information of not intercepting the read-write is received, setting pDiskNo to a preset value, and setting an happRespond event through a SetEvent function to inform a disk filter driver.
Preferably, the working method of the disk filter drive execution unit includes:
receiving the happpRespond event by the disk filter driver;
and the disk filter driver judges whether the pDiskNo is consistent with the disk number of the currently accessed new disk, if so, intercepts the read-write of the new disk, forbids system access, and if not, does not intercept the read-write of the new disk and allows the system access.
Preferably, the access management system for the bad disk further includes a disk filter driver installation module, and the working method of the disk filter driver installation module includes:
copying the disk filter driver installation file to c under windows 32 drivers;
and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
Preferably, the process of executing driverlentry in the disk filter drive installation file by the system includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
Compared with the prior art, the beneficial effects of the method are detailed as follows: the access management method for the bad disk comprises the steps that an application program and a disk filter driver are initialized, when a new disk is accessed, the disk filter driver writes a disk number of the new disk into a pDiskNo, a hNotifyEvent event is set to inform the application program that the new disk is accessed, the application program prompts a user to select a disk processing mode after receiving a hNotifyEvent event, and informs the disk filter driver of the pDiskNo and an hAppRespond event according to the selection of the user, the disk filter driver intercepts or does not intercept the reading and writing of the new disk according to the pDiskNo and the hAppRespond event, so that after the system is accessed to the new disk with the possibly bad sector, recovery software has an opportunity to access the new disk data to perform recovery operation, the phenomenon that a drive at the bottom layer of windows is jammed or other system abnormal conditions are avoided, and the new disk data can be directly read through an ATA instruction.
Drawings
In order to illustrate the embodiments of the present invention more clearly, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings can be obtained by those skilled in the art without inventive effort.
Fig. 1 is a schematic flowchart of an access management method for a bad disk according to an embodiment of the present invention;
fig. 2 is a schematic flowchart of an application initialization method according to an embodiment of the present invention;
fig. 3 is a schematic flowchart of a method for monitoring and processing new disk access by a disk filter driver according to an embodiment of the present invention;
FIG. 4 is a diagram illustrating a disk filter driver in a driver stack of a disk according to an embodiment of the present invention;
FIG. 5 is a diagram illustrating a driver stack with a dynamic disk filter driver according to an embodiment of the present invention;
fig. 6 is a schematic structural diagram of an access management system for a bad disk according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without any creative work belong to the protection scope of the present invention.
In order to make the technical solutions of the present invention better understood by those skilled in the art, the present invention will be further described in detail with reference to the accompanying drawings and specific embodiments.
The invention principle of the invention is as follows: when a disk with a physical bad sector is accessed, in order to prevent abnormal conditions caused by the bad sector of a windows system, the access of the disk is limited to prevent the windows from loading a partition and a file system. After accessing a disk with a bad sector, the recovery software has an opportunity to access the disk data for recovery operation, and special processing is also needed for reading the bad sector, otherwise, deadlock of a windows bottom layer drive is caused, and if the read operation cannot be performed by using a read file which is a common function, the disk data needs to be directly read by an ATA instruction. In the patent, the default is to default the accessed new disk to be a bad disk, so that the user can select a processing mode to avoid abnormal conditions caused by bad sectors in the new disk.
As shown in fig. 1, an embodiment of the present invention provides a bad disk access management method, applied to an application program and a disk filter driver, including:
s11: the application program creates two global event objects hNotifyEvent and hAppRespond, allocates a memory position pDiskNo for storing a disk number, transmits the hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver and waits for the hNotifyEvent event;
s12: the disk filter driver receives hNotifyEvent, hAppRespond and pDiskNo transmitted by an application program;
s13: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo, sets a hNotifyEvent event to inform an application program that the new disk is accessed, and waits for an hAppRespond event;
s14: after receiving the hNotifyEven event, the application program prompts a user to select a disk processing mode and sets a pDiskNo event notification disk filter driver and an hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
s15: and the disk filter driver receives the happpRespond event and decides to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
Specifically, after the computer is normally started up and an application program and a disk filter driver are installed, the access of a new disk is automatically monitored, and a user is prompted whether to perform limited reading and writing on the new disk. The disk filter driver runs in a windows kernel layer, the application program runs in a windows application layer, and data exchange is carried out between the disk filter driver and the application program.
As shown in fig. 2, the method of S11 includes:
s111: an application program creates two global event objects hNotifyEvent and hAppRespond through a CreateEvent function and allocates a memory position pDiskNo for storing a disk number;
s112: the application program transmits hNotifyEvent, hAppRespond and pDiskNo to the disk filter driver through a DeviceIOControl function;
s113: the application calls the waitforsingleibject function to wait for the hNotifyEvent event notification of the disk filter driver.
Specifically, the application creates two event objects for sending notifications between the application and the disk filter driver, and the API createeevent provided by windows can create such objects. In addition, the application program also allocates a block of memory for storing the disk number pDiskNo, and is also used for exchanging data between the application program and the disk filter driver.
The specific work flow comprises the following steps: initiated by the application (app), these parameters are sent to the disk filter driver (filedriver) via deviceiocontrol (windows). Only the application program sends data to the disk filter driver through the deviceiocontrol, the disk filter driver cannot send data to the application program, but after the hntifyevent, happpresponse and pdiskto of the application program are obtained, the disk filter driver can operate on the objects to notify the application program, and the application program can obtain the notification of the disk filter driver by reading the states of the objects. The disk filter driver may also read the status of these objects to be notified by the application. After the application program sends hNotifyEvent, hAppRespond and pDiskNo to the disk filter driver, the application program starts a working thread to wait for hNotifyEvent, namely calls APIWaitForSingleObject (hNotifyEvent) to wait for the event notification of the disk filter driver.
It should be noted that, after receiving hntifyevent, happpresponse and pdiskto sent by the application program, the disk filter driver in S12 may operate these objects to notify the application program when a new disk accesses, and the application program may obtain notification of the disk filter driver by reading the states of these objects.
As shown in fig. 3, the method of S13 includes:
s131: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
s132: the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
s133: the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
Specifically, the behavior is a windows kernel behavior, when a new disk device is accessed, the windows kernel calls an AddDevice of a corresponding drive of the new disk device to initialize the new disk device, and the new disk device can be normally used after initialization is completed. The new disk device driver can set a filter driver, the adopted disk filter driver is the filter driver, after the AddDevice of the new disk device driver is normally finished, the windows kernel can call all the adddevices of the filter driver of the new disk device driver, and after the initialization of the drive stack is finished, the new disk device can be normally used. Therefore, if a new disk is accessed and AddDevice of the disk filter driver is called, the disk filter driver writes the disk number of the new disk device into pDiskNo, the disk filter driver sets a hntifyevent event by using a kesetevent (windows api), and the application program can obtain the event and make a next response. The disk filter driver needs to wait (call kewaiforsingleigabject (happprespond)) for the application to confirm the mode of operation for this disk.
The method of S14 includes:
after receiving the hNotifyEven event, the application program prompts the user to select a disk processing mode: intercepting reading and writing or not intercepting reading and writing; if the information of intercepting reading and writing is received, the pDiskNo is unchanged, and an happRespond event is set through a SetEvent function to inform a disk filter driver; and if the information of not intercepting the read-write is received, setting pDiskNo to a preset value, and setting an happRespond event through a SetEvent function to inform a disk filter driver.
Specifically, after receiving the hnoifyeven event, the application prompts the user to select a disk processing mode: read-write is intercepted, and interception is not carried out. If interception is selected, pDiskNo is not changed, and the happRespond is set to inform the disk filter driver. If choose not to intercept, pDiskNo is set to 0xff, hAppRespond is set to inform the disk filter driver, that is: the application tells the disk filter driver the way to do the processing by changing pdisk.
The method of S15 includes:
receiving the happpRespond event by the disk filter driver; the disk filter driver judges whether the pDiskNo is consistent with the disk number of the currently accessed new disk, if so, the read-write of the new disk is intercepted, and the system access is forbidden; if not, the new disk read-write is not intercepted, and the system access is allowed.
Specifically, the disk filter driver receives an happpRespond event, and if the pDiskNo is consistent with the disk number of the currently accessed new disk, the read-write of the new disk is intercepted, and the access of the system is forbidden; and if the pDiskNo is inconsistent with the disk number of the currently accessed new disk, enabling the new disk to work normally.
It should be noted that the access management method for the bad disk further includes S10: installing a disk filter driver and an application program; the method for installing the disk filter drive in the S10 comprises the following steps:
s101: copying the disk filter driver installation file to c under windows 32 drivers;
s102: and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
It should be noted that the process of executing, by the system in S102, driverlentry in the disk filter drive installation file includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
Specifically, the installation of the disk filter driver mainly includes: 1. window DRIVER, 2, drive OBJECT (DRIVER _ OBJECT). Each driver has a unique driver object corresponding to it, and this driver object is created by the object manager in the kernel at the time of driver loading. The DRIVER OBJECT is represented by DRIVER _ OBJECT, and the kernel loads only one instance for one DRIVER. The DRIVER _ OBJECT has a Device OBJECT, and the DRIVER creates Device _ OBJECT for each Device, which is stored in the Device OBJECT variable. When there are multiple devices, a linked list of devices is formed. DriverExtension has an important function AddDevice. When a new disk device is accessed, the system kernel calls AddDevice to notify the driver object to generate the new device. The drive OBJECT generates a new DEVICE _ OBJECT for the new disk DEVICE, and stores the new DEVICE _ OBJECT in the DeviceObject linked list structure. Except for the AddDevice function, most of the function entries externally provided by the driving object are placed in the pointer array of the majorfusion function. windows defines the IRP _ MJ _ XXX macro to index functions, IRP _ MJ _ READ and IRP _ MJ _ WRITE are function entries for new disk device READs and WRITEs. Installing a disk filter driver generally is a mode of writing an item corresponding to a registry and then restarting a windows system, and constructing an equipment stack when the system is initialized.
As shown in FIG. 4, we install a disk filter driver (fileDriver) at the top of the drive stack of the disk. The number of layers of the filter driver is not limited, and the filter driver can be developed and released by self as long as the filter driver meets the requirements of windows. Such a disk drive stack is initialized with the values of the registry at the time of starting the windows, and cannot be dynamically changed. To avoid the user restarting the system, we here dynamically enable our drivers using the hook technology of the drivers.
In order to dynamically enable our driver, only the MajorFunction of the partmgr.sys is replaced by the MajorFunction of the disk filter driver by using hook technology, and when the partmgr function is called, the corresponding function routine function of the disk filter driver is executed, and the replaced driver stack is as shown in fig. 5.
Specifically, the dynamic loading driving process includes:
1. copy filter driver. system to c under windows 32 drivers.
2. Add service filedriver for filedriver.sys with CreateService. Call StartService starts filter driver. The system will execute DriverEntry in filter driver.
3. The system executes the flow of driventery in filter driver. 3.1 initialize MajorFunction of filterDriver. 3.2 get the DRIVER _ OBJECT pointer of the partmgr.sys and save the MajorFunction of the partmgr.sys. 3.3 replace the MajorFunction of partmgr.
4. MajorFunction processing flow of filedriver: 4.1 the MajorFunction of the disk filter driver performs corresponding processing according to the request of the application program, for example, if the request is a read-write request, the setting is performed according to the application program, and if the request is a block read-write request, the request is directly ended. If not, 4.2 is reached. 4.2 go this request to the MajorFunction counterpart function that holds partmgr.
As shown in fig. 6, the present invention further provides a bad disk access management system, which includes an application module 21 and a disk filter driver module 22, where the application module 21 runs at an application layer of the system, the disk filter driver module 22 runs at a kernel layer of the system, and the application module 21 includes:
an application initialization unit 211, configured to create two global event objects hntifyevent and happpresponse, allocate a memory location pDiskNo storing a disk number, transmit hntifyevent, happpresponse, and pDiskNo to a disk filter driver, and wait for a hntifyevent event;
the application program execution unit 212 is used for prompting a user to select a disk processing mode after receiving the hNotifyEven event, and setting a pDiskNo event and a hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
the disk filter driver module 22 includes:
the disk filter driver initialization unit 221, configured to receive, by the disk filter driver, hntifyevent, happpresponse and pdiskto sent by the application;
a disk filter driver monitoring unit 222, configured to, when the routine function AddDevice is called, write a disk number of a new disk into pDiskNo by the disk filter driver, set a hNotifyEvent event to notify an application that the new disk is accessed, and wait for an happpresponse event;
and the disk filter driver execution unit 223 is used for receiving the happpRespond event and determining to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
It should be noted that the operating method of the application initialization unit 211 includes:
creating two global event objects hNotifyEvent and hAppRespond through a CreateEvent function, and allocating a memory position pDiskNo for storing a disk number;
transmitting hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver through a DeviceIOControl function;
calling the waitfonsileobject function waits for the hNotifyEvent event notification of the disk filter driver.
It should be noted that the working method of the disk filter drive monitoring unit 222 includes:
when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
It should be noted that the working method of the application execution unit 212 includes:
after receiving the hNotifyEven event, the application program prompts the user to select a disk processing mode: intercepting reading and writing or not intercepting reading and writing;
if the information of intercepting reading and writing is received, the pDiskNo is unchanged, and an happRespond event is set through a SetEvent function to inform a disk filter driver;
and if the information of not intercepting the read-write is received, setting pDiskNo to a preset value, and setting an happRespond event through a SetEvent function to inform a disk filter driver.
It should be noted that the working method of the disk filter driver execution unit 223 includes:
receiving the happpRespond event by the disk filter driver;
and the disk filter driver judges whether the pDiskNo is consistent with the disk number of the currently accessed new disk, if so, intercepts the read-write of the new disk, forbids system access, and if not, does not intercept the read-write of the new disk and allows the system access.
It should be noted that the system further includes a disk filter driver installation module, and the working method of the disk filter driver installation module includes:
copying the disk filter driver installation file to c under windows 32 drivers;
and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
It should be noted that the process of the system executing driveentry in the disk filter drive installation file includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
For the description of the features in the embodiment corresponding to fig. 6, reference may be made to the related description of the embodiments corresponding to fig. 1 to fig. 5, which is not repeated here.
The method and system for managing access to a bad disk according to the embodiments of the present invention are described in detail above. The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description. It should be noted that, for those skilled in the art, it is possible to make various improvements and modifications to the present invention without departing from the principle of the present invention, and those improvements and modifications also fall within the scope of the claims of the present invention.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
Claims (10)
1. A bad disk access management method is applied to an application program and a disk filter driver, wherein the disk filter driver runs in a windows kernel layer, and the application program runs in a windows application layer, and the method comprises the following steps:
s11: the application program creates two global event objects hNotifyEvent and hAppRespond, allocates a memory position pDiskNo for storing a disk number, transmits the hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver and waits for the hNotifyEvent event;
s12: the disk filter driver receives hNotifyEvent, hAppRespond and pDiskNo transmitted by an application program;
s13: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo, sets a hNotifyEvent event to inform an application program that the new disk is accessed, and waits for an hAppRespond event;
s14: after receiving the hNotifyEven event, the application program prompts a user to select a disk processing mode and sets a pDiskNo event notification disk filter driver and an hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
s15: and the disk filter driver receives the happpRespond event and decides to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
2. The method for managing access to a bad disk according to claim 1, wherein the method of S11 comprises:
s111: an application program creates two global event objects hNotifyEvent and hAppRespond through a CreateEvent function and allocates a memory position pDiskNo for storing a disk number;
s112: the application program transmits hNotifyEvent, hAppRespond and pDiskNo to the disk filter driver through a DeviceIOControl function;
s113: the application calls the waitforsingleibject function to wait for the hNotifyEvent event notification of the disk filter driver.
3. The method for managing access to a bad disk according to claim 1, wherein the method of S13 comprises:
s131: when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
s132: the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
s133: the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
4. The method for managing access to a bad disk according to claim 1, further comprising S10: installing a disk filter driver and an application program; the method for installing the disk filter drive in S10 includes:
s101: copying the disk filter driver installation file to c under windows 32 drivers;
s102: and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
5. The method for managing access to a bad disk according to claim 4, wherein the step of executing a drivernetry in a disk filter driver installation file by the system in S102 includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
6. The bad disk access management system is characterized by comprising an application program module and a disk filter driving module, wherein the application program module runs in an application layer of the system, the disk filter driving module runs in a kernel layer of the system, and the application program module comprises:
an application program initialization unit, which is used for creating two global event objects hNotifyEvent and hAppRespond, allocating a memory position pDiskNo for storing a disk number, transmitting the hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver and waiting for the hNotifyEvent event;
the application program execution unit is used for prompting a user to select a disk processing mode after receiving the hNotifyEven event and setting a pDiskNo event and an hAppRespond event notification disk filter driver according to the disk processing mode selected by the user;
the disk filter driver module includes:
the disk filter driver initialization unit is used for the disk filter driver to receive hNotifyEvent, hAppRespond and pDiskNo transmitted by the application program;
the disk filter driver monitoring unit is used for writing a disk number of a new disk into pDiskNo when the routine function AddDevice is called, setting a hNotifyEvent event to inform an application program that the new disk is accessed, and waiting for an hAppRespond event;
and the disk filter drive execution unit is used for receiving the happpRespond event and determining to intercept or not intercept the read and write of the new disk according to the pDiskNo and the disk number of the new disk.
7. The system for managing access to a bad disk according to claim 6, wherein the method for operating the application initialization unit comprises:
creating two global event objects hNotifyEvent and hAppRespond through a CreateEvent function, and allocating a memory position pDiskNo for storing a disk number;
transmitting hNotifyEvent, hAppRespond and pDiskNo to a disk filter driver through a DeviceIOControl function;
calling the waitfonsileobject function waits for the hNotifyEvent event notification of the disk filter driver.
8. The system for managing access to a bad disk according to claim 6, wherein the method of operating the disk filter driver monitor unit comprises:
when a routine function AddDevice of the disk filter driver is called, the disk filter driver writes a disk number of a new disk into pDiskNo;
the disk filter driver sets hNotifyEvent events through a KeSetEvent function;
the disk filter driver calls the KeWaitForSingleObject function to wait for the application's happprespond event notification.
9. The bad disk access management system of claim 6, further comprising a disk filter driver installation module, wherein the operation method of the disk filter driver installation module comprises:
copying the disk filter driver installation file to c under windows 32 drivers;
and adding a disk filter drive service for the disk filter drive installation file by using a createServer function, calling a StartService function to start the disk filter drive installation file, and executing DriverEntry in the disk filter drive installation file by the system.
10. The system for accessing and managing a bad disk according to claim 9, wherein the process of the system executing driverlentry in the disk filter driver installation file includes:
initializing the Majorfunction of the disk filter driver;
acquiring a DRIVER _ OBJECT pointer of the partmgr.sys, and storing the Majorfunction of the partmgr.sys;
sys is replaced by the MajorFunction of the disk filter driver;
and the Majorfunction of the disk filter driver performs corresponding processing according to the request of the application program, or transfers the request to the Majorfunction corresponding function of the saved part map.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010457882.XA CN111367707B (en) | 2020-05-27 | 2020-05-27 | Bad disk access management method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010457882.XA CN111367707B (en) | 2020-05-27 | 2020-05-27 | Bad disk access management method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111367707A CN111367707A (en) | 2020-07-03 |
| CN111367707B true CN111367707B (en) | 2020-09-11 |
Family
ID=71209625
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010457882.XA Active CN111367707B (en) | 2020-05-27 | 2020-05-27 | Bad disk access management method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111367707B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108205480B (en) * | 2017-12-28 | 2021-10-26 | 大众问问(北京)信息科技有限公司 | Abnormity processing method and device, intelligent rearview mirror and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101464820A (en) * | 2009-01-16 | 2009-06-24 | 中国科学院计算技术研究所 | Continuous data protection method and system for disk apparatus |
| CN201477576U (en) * | 2009-08-31 | 2010-05-19 | 浙江机电职业技术学院 | Rapid automatic backup device of notebook computer |
| CN103440465A (en) * | 2013-08-29 | 2013-12-11 | 成都卫士通信息安全技术有限公司 | Mobile storage medium safety control method |
| CN105260132A (en) * | 2015-09-18 | 2016-01-20 | 久盈世纪（北京）科技有限公司 | Method and device for hot loading disk filter drive |
| CN109814810A (en) * | 2019-01-21 | 2019-05-28 | 郑州云海信息技术有限公司 | The processing method and processing device of hard disk failure sector in a kind of RAID array |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9390275B1 (en) * | 2015-01-27 | 2016-07-12 | Centurion Holdings I, Llc | System and method for controlling hard drive data change |
| US9817675B1 (en) * | 2017-01-31 | 2017-11-14 | Hytrust, Inc. | Methods and systems for attaching an encrypted data partition during the startup of an operating system |
-
2020
- 2020-05-27 CN CN202010457882.XA patent/CN111367707B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101464820A (en) * | 2009-01-16 | 2009-06-24 | 中国科学院计算技术研究所 | Continuous data protection method and system for disk apparatus |
| CN201477576U (en) * | 2009-08-31 | 2010-05-19 | 浙江机电职业技术学院 | Rapid automatic backup device of notebook computer |
| CN103440465A (en) * | 2013-08-29 | 2013-12-11 | 成都卫士通信息安全技术有限公司 | Mobile storage medium safety control method |
| CN105260132A (en) * | 2015-09-18 | 2016-01-20 | 久盈世纪（北京）科技有限公司 | Method and device for hot loading disk filter drive |
| CN109814810A (en) * | 2019-01-21 | 2019-05-28 | 郑州云海信息技术有限公司 | The processing method and processing device of hard disk failure sector in a kind of RAID array |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111367707A (en) | 2020-07-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US5564040A (en) | Method and apparatus for providing a server function in a logically partitioned hardware machine | |
| JP5015665B2 (en) | Method, apparatus, and computer program for sharing kernel services between kernels | |
| US6889340B1 (en) | Use of extra firmware flash ROM space as a diagnostic drive | |
| CA2059921C (en) | Scsi device drivers for multitasking operating system | |
| JP3459694B2 (en) | Method and system for selectively applying an appropriate object ownership model | |
| US5640600A (en) | Storage controller and bus control method for use therewith | |
| US5832513A (en) | Detecting significant file system alterations during execution of a storage media software utility | |
| US20140196040A1 (en) | Virtual machine crash file generation techniques | |
| US7395420B2 (en) | Using protected/hidden region of a magnetic media under firmware control | |
| EP1035472A2 (en) | Loading configuration data | |
| EP1691287A1 (en) | Information processing device, process control method, and computer program | |
| US7809985B2 (en) | Offline hardware diagnostic environment | |
| US20110113229A1 (en) | Method for Shortening the Boot Time of a Computer System | |
| US20130036431A1 (en) | Constraining Execution of Specified Device Drivers | |
| US7100162B2 (en) | System and method for process management | |
| US6950962B2 (en) | Method and apparatus for kernel module testing | |
| CN111367707B (en) | Bad disk access management method and system | |
| US6178550B1 (en) | Mechanism for optimizing location of machine-dependent code | |
| US7168002B2 (en) | Preservation of error data on a diskless platform | |
| US5694582A (en) | Operation system independent polled interface for extension BIOS (XBIOS) operations | |
| US7143281B2 (en) | Method and apparatus for automatically changing kernel tuning parameters | |
| WO2002079999A1 (en) | Apparatus and method for protecting data on computer hard disk and computer readable recording medium having computer readable programs stored therein | |
| US6907521B2 (en) | Enabling video BIOS and display drivers to leverage system BIOS platform abstract | |
| US8468277B1 (en) | Installation of a device driver | |
| US6880077B2 (en) | Enabling communication between video BIOS and graphics drivers |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |