The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am trying to develop a solution where I want to handle the complete file(data+metadata) for a specific process.
My design is to first intercept IRP_MJ_CREATE -> check process id -> if process match -> check file name and match for the file names I am interested in.
If its an IRP_MJ_CREATE from my process of interest and the file I am interested in, I associate my own fscontext with the TargetFileObject and and do FLT_PREOP_COMPLETE, thereby becoming owner of the FileObject. ( there is communication involved with userspace which is not revelant to my question)
This way I control any subsequent ops on the TargetFileObject until the TargetFileObject is closed (explicitly or at process termination), by simply comparing the fscontext value of the file object.
My life was going good till now, and I was able to support some basic operations like IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_CLEANUP and IRP_MJ_CLOSE.
But now I am implementing support for IRP_MJ_QUERY_INFORMATION and IRP_MJ_SET_INFORMATION, which is where I got confused.
I am logging ops in pre-operation, and I see on my test system(NTFS file system) that if I keep the system idle for long and then run my test process which tries to open a test file, it leads to a bunch of IRPs, as opposed to seeing only one IRP_MJ_CREATE:
IRP MJ:255 IRP MN:0
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Writing WDF Drivers||12 September 2022||Live, Online|
|Internals & Software Drivers||23 October 2022||Live, Online|
|Kernel Debugging||14 November 2022||Live, Online|
|Developing Minifilters||5 December 2022||Live, Online|