The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm Currently writing a File Replication filter for VHDs - Since I am rather new to the topic I have a few questions about the Scope of certain parameters of the IRP.
Would be great if someone had the answers - or point me to a source/google search where I can expand my understanding about the Topics.
Could I use the IOPB.TargetFileObject from the PFLT_CALLBACK_DATA for my own read needs?
1.1. If no, even If I did an FltObjectReference beforehand? Is this even a sensible question or am I completely mistaken with how I think about this?
1.2. If yes, would It make more sense to Open the File for myself? I kind of don't want to have to compete with shared Acces rights
Can I Use the Pointer Address to the IOPB.TargetFileObject to find out if further IRPs write to the same file?
2.1. Could I miss IRPs from other Processes since they might use another File Object Addres - Or does Windows use the same Address to reference the File globally and toss it if nothing is referencing to it anymore?
Am I correct in my assumption that the WriteBuffer / MDL in a writing IRP is only valid until the IRP is done?
3.1. And if I want to write the same changes to another File I have to copy said buffer?
Each write/read from any Programm etc has to Open, do, Close the File. Is there any way to know if the IRPs I'm filtering are from this Chain/transaction?
4.1 I think the FileObject Pointer from the Open till the Close should be the same. Can someone Verify that?
The MDL in the FLTWriteFile seems to be Optional? What advantages do I have if I create one for My Write?
That's it - a big Thank you in advance!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|