Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How to prevent directory creation in minifilter?

allrounderallrounder Member Posts: 5

Hello.

I want to know how to prevent directory creation in minifilter.

I searched for a lot of topics I was curious about on this website, but I couldn't see exactly what I wanted (maybe because I don't understand them), so I wrote it again.
Please understand.

In scanner samples, IRP_MJ_CREATE, IRP_MJ_WRITE post callback function

        FltCancelFileOpen( FltObjects->Instance, FltObjects->FileObject );

        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
        Data->IoStatus.Information = 0;

        returnStatus = FLT_POSTOP_FINISHED_PROCESSING;

It is written as above.

That code can block file creation and modification.

I think that code also not perfect.

In the scanner example, if there is a certain word in the txt file, it says that access is denied and the notepad opens, but I don't think the notepad itself should open.

I also want to know how to make the notepad itself not open.

Well anyway, I want to know how to prevent directory creation.

I need to help.

Thank you.

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,152

    What notepad does if access is denied is notepads problem. Not yours.

    Directories are created when a constructive created (FILE_CREATE, FILE_OPEN_IF, FILE_TRUNCATE_IF) happens when the FILE_ATTRIBUTE_DIRECTORY) bit is set.

    Be careful of the last two, they also work for existing files and directories (at which stage the attributes are ignore).

    Id strongly suggest you spend some time playing with filetest. It will teach you a great deal of the basics and not so basics of the file io subsystem.

  • allrounderallrounder Member Posts: 5
    edited August 21

    @rod_widdowson

    Thanks to reply.

    I'm really, really sorry, but I'm not sure your answer is about the minifilter.

    sorry...

    FILE_CREATE, FILE_OPEN_IF, FILE_TRUNCATE_IF, FILE_ATTRIBUTE_DIRECTORY These terms are the first words I saw while searching for minifilter.

    Isn't this work in IRP_MJ_CREATE or IRP_MJ_WRITE??

    sorry.....

    First, I understood that it would be helpful to do with a program called filtest.

    If I play with the filetest program, does it help me to program even the minifilter?

    Thank you.

    Post edited by allrounder on
  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,152

    If you play with filetest it will help you understand the parameters which get sent to you minifilter.

    In this case the parameters to NtCreate map - almost 1 to one - to the parameters in the FLT_CALLBACK_DATA for an IRP_MJ_CREATE.

    Specifically

    • FILE_ATTRIBUTE_DIRECTORY is set in the 'File Attributes' button of the NtCreateFile tab in filetest and turns up in Data->Iopb->Parameters.Create
    • FILE_TRUNCATE_IF is set in CreateDisposition and turns up in Data->Iopb->Parameters.Options >> 24.

    Build an example filter. Set breakpoints. Exercise with FileTest while reading the document.

    AFAIK the only decent training material is the (quite excellent) OSR course so enrol in that or teach yourself - and expect that the shortest time that it will take will be 6 months with a course of 12 without.

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,152

    I beg you pardon - I was working from away from the sources. When I said FILE_TRUNCATE_IF I actually means FILE_OVERWRITE_IF

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 30 Nov 2020 LIVE ONLINE
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Developing Minifilters Early 2021 LIVE ONLINE