Hello guys
I want to intercept calls to NetShareEnum function (which enumerates shared folders) and for a specific application, I want to add a “fake” folder from post ops callback. I then would process files/folders enumeration in that shared folder from IRP_MJ_DIRECTORY_CONTROL callbacks from my minifilter.
Is there a way to achieve this? I couldn’t find anything useful from MSDN.
Thanks
It is not as simple as intercepting a specific enumeration request in kernel mode.
The enumeration of network shares happens in user mode. The network file system registers a network provider DLL that exports enumeration functions called when the O/S wants to enumerate the shares. The network provider DLL then does whatever processing is necessary to populate these enumerations with info from the server.
What exactly are you trying to accomplish? Maybe there’s a better way.
I see, so this task needs user mode hooking. Thanks Scott