I writing a Minifilter driver and I'm using the same driver to get other
system information .I would like to get some advices on how to build it...
I installed the driver using SCM and inf file to enable the Minifilter,
is that the right way?
I don`t need to have the information from the minifilter in user space
continuously and i would like enable or disable the minifilter, I had
thought 2 ways to do this:
1.- Load and unload the minifilter whatever i want without unload
the driver, is possible? I tried it but i havent had good results...
2.- Pass to kernel a flag through IOCTL to notify the Minifilter
that not send the information( although the Minifilter continue
capturing information ). I dont know if it is this righ way...