When my minifilter apply change on file, obviously, the File System push some directory change notification,
1) Is there a way to tell the File System that my action need to be hidden ? (I guess I already know the answer from the FastFAT sample ...)
I think I could intercept IRP_MN_NOTIFY_CHANGE_DIRECTORY and try to remove my notifications, with countless difficulties , butI don't like this idea as it is error-prone.
2) If the user buffer is too small to catch this notifications, in the post operation, will the returned buffer length be 0 like ReadDirectoryChangesW or could I remove some notifications before that ?
Thank you !
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Writing WDF Drivers||21 Oct 2019||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|
|Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||27 Apr 2020||OSR Seminar Space & ONLINE|