The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I have a minifilter driver which shadows FILE_OBJECTs to create the illusion that create operations succeeded when the ACLs would normally have caused them to fail (see earlier post).
If I unload my driver while one of these FILE_OBJECTs is open, that FILE_OBJECT will find its way to the ntfs driver and cause a BSOD because the whole approach hangs on my driver being present in order to switch these invalid 'upper' FILE_OBJECTs for corresponding valid 'lower' ones. Is there a way I can defer my driver being unloaded until none of these upper FILE_OBJECTs are in existence?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|