您好！在VFS层可以成功截获file_operations中read（or write）函数的指针，针对ext3文件系统的，但是对u盘怎么不行，只能打开某个具体的文件才可以截获。
代码如下：
#include
#include
#include
#include
#include
#include
char *aim = "/mnt/usb/a"; －－－－－－> 我在u盘中建的文件a
MODULE_AUTHOR("petsatan@sohu");
MODULE_DESCRIPTION("Get the kernel function address ");
MODULE_LICENSE("GPL");
typedef ssize_t (*read_t)(struct file *, char *, size_t, loff_t *);
read_t orig_aim_read = NULL;
ssize_t encry_read(struct file *fp , char *buf , size_t count , loff_t *ppos)
{
ssize_t encryfile;
printk("<0> Congratulation! \n");
encryfile = orig_aim_read(fp ,buf ,count ,ppos);
return encryfile;
}
int switch_read(const char *p , read_t *orig_read , read_t new_read)
{
struct file *filep;
filep = filp_open(p , O_RDONLY , 0);
if(IS_ERR(filep))
return -1;
if(orig_read)
*orig_read = filep->f_op->read;
printk("read operation address:------- %p ------\n", filep->f_op->read);
filep->f_op->read = new_read;
filp_close(filep,0);
return 0;
}
int unswitch_read(const char *p, read_t orig_read)
{
struct file *filep;
filep = filp_open(p , O_RDONLY , 0);
if(IS_ERR(filep))
return -1;
filep->f_op->read = orig_read;
filp_close(filep,0);
return 0;
}
static int encryfile_init(void)
{
switch_read(aim , &orig_aim_read , encry_read);
printk(" <1>read() has switch!\n");
return 0;
}
static void encryfile_cleanup(void)
{
unswitch_read(aim, orig_aim_read);
printk("<2>read() has unswitch! \n");
}
module_init(encryfile_init);
module_exit(encryfile_cleanup);
期待您的回信！！！ 急！！！