Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Creating an ADS stream in a Mini Filter

IanMIanM Member - All Emails Posts: 34

I have a minifiler driver which tracks files and tags them with ADS when it has seen certain data being written. My problem is that sometimes the file is written to by the Cache Manager after the Cleanup so I have to wait until the Close to be certain that I have seen all of the data written to the file. Unfortunately the pre-close is IRQL <= APC_LEVEL so I can't use FltCreateFile. I don't want to make the tagging asynchronous because sometimes the file gets renamed after it has been closed.

Can anyone suggest a way to get around this? Can I prevent the caching for the files I'm interested in, or somehow do file operations at APC_LEVEL?




  • IanMIanM Member - All Emails Posts: 34
    P.S. Why can't I create a file at APC level anyway?
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA