Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Find the File type in mini filter driver

ANTUCWANTUCW Member Posts: 9
edited April 25 in NTFSD

Hi all. I have a file system mini filter driver.Here I am trying to find the file type(eg .txt,.pdf) using file signature. Can you provide any solution?

Comments

  • ANTUCWANTUCW Member Posts: 9

    Is there a possible way to get the file type using FltGetFileSystemType function

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,123

    Obviously you need to read the file if you want to know what type of file it is. You absolutely, 100% do not want to do this in kernel mode, down that path lies madness (and an endless attack surface). FltCreateSectionForDataScan and a user mode parser?

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA