Disabling ( By disrupting it this way ) device

bdemirkol

I want to disable some devices by using driver. I know this can be in user mode but i dont want discuss this case right now. Just i can say you user mode disabling is not safe enought. Users can abuse this approach. I attached some links. I realized a dlp application can disable as in screenshot. I think this is disrupting. Do you have any idea how can I do this as shown in screenshot?

https://imageupload.io/1txEEOUwdu.g

Peter_Viscarola_(OSR)

Sure. You write a filter driver that filters the device(s) you want to disable.

Peter

bdemirkol

If you send the code, I want to write it by looking at the code.

Regards.

Tim_Roberts

If you send the code, I want to write it by looking at the code.

That's not how this works. We don't write the code, YOU write the code. There are lots of examples of filter drivers in the WDK samples.

MBond2

note that when Peter says 'disable by filtering' he does not mean that it will appear disabled in device manager. what he means is that you will render the device inoperable by failing the various IRPs before they get to the real device driver and the real hardware. In order to do this, you need to understand about the device stack(s) that you plan to attach to and how to identify the device instance(s) that you intend to cripple in this way. Be careful that you don't cripple too much as it is very easy to render the whole system inoperable in this way

bdemirkol

@MBond2 said:
note that when Peter says 'disable by filtering' he does not mean that it will appear disabled in device manager. what he means is that you will render the device inoperable by failing the various IRPs before they get to the real device driver and the real hardware. In order to do this, you need to understand about the device stack(s) that you plan to attach to and how to identify the device instance(s) that you intend to cripple in this way. Be careful that you don't cripple too much as it is very easy to render the whole system inoperable in this way

Thank you for your detailed answer and suggestions. I will consider them.