Can I block the DLL use of an application using mini filter.

I need to block the dll file use of the application using minifilter.
Is it possible ?
Please help

The easiest way I know to block use of a dll is to handle IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION, and check for PageProtection of PAGE_EXECUTE (or one of the other page execute values).

@rstruempf thank you
I tried using IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION but I could’t block the dll by this call back

Because the event didn’t occur? I’ve never seen an exe or dll executed that wasn’t preceded by this IRP. There are those here who understand this far better than I do, who will hopefully correct me if I am wrong, but I believe this is required for code execution. It is the act that results in the image section being attached to the file object which is a mapping required for process execution.

Again, this is my limited understanding, but this is a pseudo-IRP that cannot be treated like a normal IRP based request, but it can be blocked by setting the IoStatus.Status to access denied in the pre-op and returning preop finished processing.

_Ron

Thank you @rstruempf

Actually i need to block some dll’s used by explorer.exe for burning the CD ROM but i fail to find the request from IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION

Then I suppose the DLLs in question are already loaded and running by the time you are looking to block them, in which case there are no IRPs associated with the execution. There are undoubtedly IRPs to access the CD, but I can’t advise you there

Thank you @rstruempf