Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


MiniFilter File write protection Issue

nvdtrialnvdtrial Member Posts: 3

Hi All,

I have recently developed a minifilter based driver,
I have saved some specific folder's files from deletion, rename and modification.
It is working as per expected.

But, I have observed one peculiar issue in case of file modification protection.
If I modify protected file in notepad.exe and try to save it, it restricts from file save and file protection works as per expected.

But When I open the protected file in notepad++.exe and modify it, and try to save it, it got notification for save failed.
then I tried to close the modified file in notepad++.exe, it shows a msg pop up below :

"This File has been modified by another Program. Do you want to reload it and lose the changes made in notepad++."

if I press ** yes button**, all the content of the file get lost and file become empty and of size zero byte.

How to overcome this issue from file content get lost in notepad++.exe.

Any input will be appreciable.
TIA

Comments

  • Doug_NDoug_N Member - All Emails Posts: 110

    These two statements:

    I have saved some specific folder's files from deletion, rename and modification.

    and

    all the content of the file get lost and file become empty and of size zero byte.

    can't both be true if your minifilter really is blocking ALL modifications. Is it just that notepad++ shows an empty file, but the file contents are still safe? If the file contents have actually been changed, some modification is still slipping past your minifilter.

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,527

    Running ProcMon will let you see what file operations happen and their results.

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online
Writing WDF Drivers 22 May 2023 Live, Online