I'm facing a weird problem and need some help to understand what I'm doing wrong (if so).
I have a minifilter that does FileObject hooking/breaking, it intercepts request from above and creates new requests (with new FileObjects) to below minifilters. It records the matching between the upper FileObject and the created FileObject that goes below.
I had some BSODs because my filter didn't implement the PFLT_GENERATE_FILE_NAME callback and replace the CallbackData->Iopb->TargetFileObject. So the file system (and minifilters below me) were receiving unknown file objects and then it led to BSODs.
I implemented the PFLT_GENERATE_FILE_NAME callback and hooked/replaced its CallbackData->Iopb->TargetFileObject (and called FltSetCallbackDataDirty()) in order to have mini filters below me receive a FileObject they know (so it doesn't BSOD).
But I'm altering the CallbackData of an ongoing IRP. When the PFLT_GENERATE_FILE_NAME callback is over and the minifilter (above me) that invoked it has the information it wanted, it has a modified TargetFileObject. So this minifilter and all the minifilters until mine will see a TargetFileObject they aren't supposed to see.
Am I missing something in the documentation? They is no "post callback"/mechanism so that I can put back the TargetFileObject.
Is someone able to tell me where I'm wrong?
If something isn't clear in my explanations don't hesitate to ask me to reformulate or for more informations.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|