The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I recall years back when Vista first came out having a number of clients panic because their user mode disk utilities could no longer write to the disk without having a kernel driver component which added the SL_FORCE_DIRECT_WRITE flag to a write IRP. I've pretty much just worked off the assumption for the last 10+ years that you couldn't write an MBR from user mode for security reasons. But to my surprise today I found that simple CreateFile/WriteFile on \.\PhysicalDriveX allows updating sector 0 on both an MBR and GPT style disk (even while online and in use) as long as the process is run as admin. Was this relaxed at some point or did I just misunderstand it all these years? Seems awfully easy to modify the MBR, though you could make the argument that if a user has admin access they could just as well load their own driver to perform the IO that way... but with that line of thinking I'm not clear what the purpose of the IRP flag and the protection mechanism was ever meant to be in the first place. In other words, you can't open \.\PhysicalDriveX unless you are admin anyway, so what is the point of an additional write restriction which goes away if you are admin?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|