本帖最后由 Tariel 于 2021-9-13 20:12 编辑
焦点在微信的输入框里一直呆着,呆一整天就会触发,切换一下输入法就会发现user.uwl丢了。已经复现两次。
用火绒剑监控了一下,发现正常重写user.uwl时, 一系列操作后最后一个FILE_truncate的eof是对的,大小能对上;
然而在用户词库丢失时,这个eof本身就都不对了……
这是昨晚上焦点在Everything里面的时候的监控情况:
23:29:43:352, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl.bak, access:0x00100100 alloc_size:0 attrib:0x00000000 share_access:0x00000007 disposition:0x00000001 options:0x00200020 , 0x00000000 [操作成功完成。 ],
23:29:43:352, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl.bak, access:0x00010080 alloc_size:0 attrib:0x00000000 share_access:0x00000007 disposition:0x00000001 options:0x00200040 , 0x00000000 [操作成功完成。 ],
23:29:43:353, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl.bak, access:0x00010080 alloc_size:0 attrib:0x00000000 share_access:0x00000007 disposition:0x00000001 options:0x00200040 , 0x00000000 [操作成功完成。 ],
23:29:43:353, Everything.exe, 8052:5800, 8052, FILE_remove, ...\HuayuPY\wordlib\user.uwl.bak, , 0x00000000 [操作成功完成。 ],
23:29:43:353, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl, access:0x00120089 alloc_size:0 attrib:0x00000000 share_access:0x00000005 disposition:0x00000001 options:0x00200044 , 0x00000000 [操作成功完成。 ],
23:29:43:354, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl, access:0x00120089 alloc_size:0 attrib:0x00000000 share_access:0x00000005 disposition:0x00000001 options:0x00200064 , 0x00000000 [操作成功完成。 ],
23:29:43:354, Everything.exe, 8052:5800, 8052, FILE_touch, ...\HuayuPY\wordlib\user.uwl.bak, access:0x0017019F alloc_size:513024 attrib:0x00000020 share_access:0x00000000 disposition:0x00000005 options:0x00000044 , 0x00000000 [操作成功完成。 ],
23:29:43:354, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl.bak, access:0x0017019F alloc_size:0 attrib:0x00000000 share_access:0x00000000 disposition:0x00000005 options:0x00000044 , 0x00000000 [操作成功完成。 ],
23:29:43:355, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl.bak, access:0x0017019F alloc_size:0 attrib:0x00000000 share_access:0x00000000 disposition:0x00000003 options:0x00000064 , 0x00000000 [操作成功完成。 ],
23:29:43:355, Everything.exe, 8052:5800, 8052, FILE_truncate, ...\HuayuPY\wordlib\user.uwl.bak, eof:0x0007D400 , 0x00000000 [操作成功完成。 ],
23:29:43:356, Everything.exe, 8052:5800, 8052, FILE_read, ...\HuayuPY\wordlib\user.uwl, offset:0x00000000 datalen:0x00020000 , 0x00000000 [操作成功完成。 ],
23:29:43:356, Everything.exe, 8052:5800, 8052, FILE_write, ...\HuayuPY\wordlib\user.uwl.bak, offset:0x00000000 datalen:0x00020000 , 0x00000000 [操作成功完成。 ],
23:29:43:357, Everything.exe, 8052:0, 8052, FILE_modified, ...\HuayuPY\wordlib\user.uwl.bak, , 0x00000000 [操作成功完成。 ],
23:29:43:357, Everything.exe, 8052:5800, 8052, FILE_truncate, ...\HuayuPY\wordlib\user.uwl, eof:0x00000000 , 0x00000000 [操作成功完成。 ],
23:29:43:357, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl, access:0x00120196 alloc_size:0 attrib:0x00000000 share_access:0x00000000 disposition:0x00000005 options:0x00000060 , 0x00000000 [操作成功完成。 ],
23:29:43:357, Everything.exe, 8052:5800, 8052, FILE_write, ...\HuayuPY\wordlib\user.uwl, offset:0x00000000 datalen:0x0007D400 , 0x00000000 [操作成功完成。 ],
23:29:43:358, Everything.exe, 8052:0, 8052, FILE_modified, ...\HuayuPY\wordlib\user.uwl, , 0x00000000 [操作成功完成。 ],
23:29:43:366, Everything.exe, 8052:0, 8052, FILE_open, ...\HuayuPY\wordlib\user.uwl, access:0x00120089 alloc_size:0 attrib:0x00000000 share_access:0x00000003 disposition:0x00000001 options:0x00000060 , 0x00000000 [操作成功完成。 ],
23:29:43:366, Everything.exe, 8052:5800, 8052, FILE_read, ...\HuayuPY\wordlib\user.uwl, offset:0x00000000 datalen:0x0007D000 , 0x00000000 [操作成功完成。 ],
23:29:44:517, Everything.exe, 8052:1912, 8052, FILE_truncate, ...\HuayuPY\wordlib\user.uwl.bak, eof:0x0007D400 , 0x00000000 [操作成功完成。 ],
23:29:45:878, Everything.exe, 8052:1912, 8052, FILE_truncate, ...\HuayuPY\wordlib\user.uwl, eof:0x0007D400 , 0x00000000 [操作成功完成。 ],
|