DiskMon运行在NT4上才加载驱动，在W2k以上平台其使用kernel event tracing实现磁盘活动的监视，

但其驱动可以跑在W2k/XP/2K3/Vista上



该驱动Hook了disk的driver dispatch例程，不仅可以监视磁盘活动，稍微改下还能拦截、修改上层对磁盘的读写，

很容易就可以搞个什么 基于Disk的 -DiskMon only run on NT4 load on the drive, more than W2k platform in its use of kernel event tracing activities to monitor the achievement of the disk, but the drive can run in W2k/XP/2K3/Vista on the Hook of the disk drive of the driver dispatch routine, not only can monitor disk activity, but also under a slight change to intercept, modify the top of the disk read and write, it is easy to Disk-based搞个what the xxx