The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
my minifilter blocks read/write access for IRP_MJ_CREATE, IRP_MJ_READ and IRP_MJ_WRITE based on the given access rules.
I'm having problem using the "safely remove hardware" option when my filter is attached to a mass storage device volume.
I tried excluding IRPs targeted to directory and volume from my access control logic with no luck.
debugging shows me that there are some file access(write access) when the "safely remove hardware" is invoked.
so the first approach to overcome this which comes to my mind is to make a list of the files being accessed and exclude them as well.
But the concern is that this list is identical on all scenarios for a given version? set aside the difference between different windows versions. (my target is win 7 and higher)
what do you suggest for this?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||15 November 2021||Live, Online|
|Writing WDF Drivers||24 January 2022||Live, Online|
|Developing Minifilters||7 February 2022||Live, Online|
|Kernel Debugging||21 March 2022||Live, Online|