hello, here is my problem in detail:
My driver program registered a callback function with PsSetCreateProcessNotifyRoutineEx. And in case a new process in "D:\" drive starting (exe file) by double click, the callback function just "wait" the user's reply by KeWaitForSingleObject or FltSendMessage, that will allow or block the process.
While the callback waiting user's decision, the Explorer's window (at file path) keep spinning, flicker and displays wait cursor. And i don't like it, i want that window execute like normal.
I don't know this can be done in Kernelmode or Usermode. I've reversed some drivers from AVs but they are too complicated and got no clue.
Could you give me any suggestion or solution? Thank you.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Writing WDF Drivers||21 Oct 2019||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|
|Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||27 Apr 2020||OSR Seminar Space & ONLINE|