Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I've seen in MSDN that minifilter can intercept SET_INFORMATION events, but from scouring GitHub and other source repos I didn't find any use cases
from what the FILE_INFORMATION_CLASS suggests this event can do many things like set rename information (maybe rename a file?)
would really appreciate if someone can enlighten me on this (maybe you got some source code example?)
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 9-13 Sept 2024 | Live, Online |
Developing Minifilters | 15-19 July 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 20-24 May 2024 | Live, Online |
Comments
Microsoft provides a large collection of driver samples: https://github.com/microsoft/Windows-driver-samples
For example: https://github.com/microsoft/Windows-driver-samples/tree/master/filesys/miniFilter/delete
FYI for future folks
this is an example of a minifilter used to detect renames using FileRenameInformation
As you said, in this case IRP_MJ_SET_INFORMATION callback will be invoked . you don't need complete source code example, you just need check that
Data->Iopb->Parameters.SetFileInformation.FileInformationClass == ClassType in a if condition and then switch between all fields of the FileInformationClass