I am filtering rename operations. In pre-callback I clear ReplaceIfExists in both FLT_PARAMETERS for IRP_MJ_SET_INFORMATION and FILE_RENAME_INFORMATION. Call FltSetCallbackDataDirty.
Before my callback called filter manager sets Iopb in FLT_CALLBACK_DATA to new value.
In post-callback I have ReplaceIfExists in FLT_PARAMETERS for IRP_MJ_SET_INFORMATION set(by fltmgr) to TRUE(should be FALSE). ReplaceIfExists in FILE_RENAME_INFORMATION still set to FALSE(as expected).
Nothing changes if I don't call FltSetCallbackDataDirty.
Is that expected behaviour ? What should I do if I want to get correct modified value in post-callback ?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Developing Minifilters||29 July 2019||OSR Seminar Space|
|Writing WDF Drivers||23 Sept 2019||OSR Seminar Space|
|Kernel Debugging||21 Oct 2019||OSR Seminar Space|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|