When my minifilter apply change on file, obviously, the File System push some directory change notification,
1) Is there a way to tell the File System that my action need to be hidden ? (I guess I already know the answer from the FastFAT sample ...)
I think I could intercept IRP_MN_NOTIFY_CHANGE_DIRECTORY and try to remove my notifications, with countless difficulties , butI don't like this idea as it is error-prone.
2) If the user buffer is too small to catch this notifications, in the post operation, will the returned buffer length be 0 like ReadDirectoryChangesW or could I remove some notifications before that ?
Thank you !
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|