The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I have simple minifilter driver that is intercepting PreCreate.
If one will use "local" UNC path to given sahe (e.g using loopback \127.0.0.1) inside my minifilter I see two requests: one coming from application that is issuing NtCreateFile (which is obvious). My driver is intercepting this call.
After that (here is my question to confirm it whether my understanding is correct) fltmgr will redirect this request to Mup (as parsed path will look MUP alike) and it will go thru SMB. in few cycles later I can see srv2 is opening same file, but this time file is properly resolved to local path. I understand right after "first" fltmgr call sytem is reparsing this request to use SMB - correct?
As I can see request coming from SMB is in fact always executed in SYSTEM thread context. I understant this is because there is thread/pool of threads working on behalf of SMB that are serving incoming requests from outside - is that correct (srv2!RfspThreadPoolNodeWorkerRun)?
I presume I know what will be the answer, but ... is it possible to anyhow find ProcessId on behalf of which given (in fact local) SMB request is performing? (Im talking about really local SMB requests)?
My minifilter is working just fine with pre-create on really local requests. Once I started to use loopback to access files some issues arised becuase I cannot find what is real accessed path - in other words - I cannot map UNC path to local drive (I guess having post callback woudl have it resolved already). If however I could process SMB requests which contains local path (but I cannot find real requestor ID) it would be enough.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|