I am trying to read a config.txt file that contains a list of paths separated by “;” from a minifilter.
config.txt file looks like:
\\Device\\HarddiskVolume2\\path1;\\Device\\HarddiskVolume2\\path2
Then, in instance_setup()
method I do:
HANDLE fileHandle = NULL;
OBJECT_ATTRIBUTES objectAttributes;
PVOID result;
result = ExAllocatePool(NonPagedPool, 65536);
PFILE_OBJECT fileObject = NULL;
UNICODE_STRING myUnicodeStr;
RtlInitUnicodeString(&myUnicodeStr, config_file_path);
InitializeObjectAttributes(&objectAttributes, &myUnicodeStr, OBJ_CASE_INSENSITIVE | OBJ_OPENIF, NULL,NULL);
IO_STATUS_BLOCK ioStatus;
FltCreateFile(flt_objects->Filter, flt_objects->Instance, &fileHandle, GENERIC_READ, &objectAttributes, &ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN, FILE_SEQUENTIAL_ONLY, NULL, 0, 0);
ObReferenceObjectByHandle(fileHandle, GENERIC_READ, NULL, KernelMode, &fileObject, NULL);
ULONG bytes_read;
FltReadFile(flt_objects->Instance, fileObject, NULL, 65536, result, FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET, &bytes_read, NULL, NULL);
FltClose(fileHandle);
//result should have the content of file
I am getting a blue screen when starting the minifilter. I´ve tested that the code works properly until FltCreateFile
(I am able to get a proper fileHandler). I do not see what I am doing wrong after this.