I'm writing a minifilter that catches IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION to examine executables. Most DLLs are shared between processes, so I only want to examine an executable the first time it is loaded, not every time it is shared to another process. The CONTROL_AREA keeps track of the reference count, but that structure isn't publically defined (yes, I know it can be seen in the debugger). So, how can I perform my scan just once, the first time the image is mapped?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Developing Minifilters||29 July 2019||OSR Seminar Space|
|Writing WDF Drivers||23 Sept 2019||OSR Seminar Space|
|Kernel Debugging||21 Oct 2019||OSR Seminar Space|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|