How to prevent directory creation in minifilter?

Hello.

I want to know how to prevent directory creation in minifilter.

I searched for a lot of topics I was curious about on this website, but I couldn’t see exactly what I wanted (maybe because I don’t understand them), so I wrote it again.
Please understand.

In scanner samples, IRP_MJ_CREATE, IRP_MJ_WRITE post callback function

        FltCancelFileOpen( FltObjects->Instance, FltObjects->FileObject );

        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
        Data->IoStatus.Information = 0;

        returnStatus = FLT_POSTOP_FINISHED_PROCESSING;

It is written as above.

That code can block file creation and modification.

I think that code also not perfect.

In the scanner example, if there is a certain word in the txt file, it says that access is denied and the notepad opens, but I don’t think the notepad itself should open.

I also want to know how to make the notepad itself not open.

Well anyway, I want to know how to prevent directory creation.

I need to help.

Thank you.

What notepad does if access is denied is notepads problem. Not yours.

Directories are created when a constructive created (FILE_CREATE, FILE_OPEN_IF, FILE_TRUNCATE_IF) happens when the FILE_ATTRIBUTE_DIRECTORY) bit is set.

Be careful of the last two, they also work for existing files and directories (at which stage the attributes are ignore).

Id strongly suggest you spend some time playing with filetest. It will teach you a great deal of the basics and not so basics of the file io subsystem.

@rod_widdowson

Thanks to reply.

I’m really, really sorry, but I’m not sure your answer is about the minifilter.

sorry…

FILE_CREATE, FILE_OPEN_IF, FILE_TRUNCATE_IF, FILE_ATTRIBUTE_DIRECTORY These terms are the first words I saw while searching for minifilter.

Isn’t this work in IRP_MJ_CREATE or IRP_MJ_WRITE??

sorry…

First, I understood that it would be helpful to do with a program called filtest.

If I play with the filetest program, does it help me to program even the minifilter?

Thank you.

If you play with filetest it will help you understand the parameters which get sent to you minifilter.

In this case the parameters to NtCreate map - almost 1 to one - to the parameters in the FLT_CALLBACK_DATA for an IRP_MJ_CREATE.

Specifically

  • FILE_ATTRIBUTE_DIRECTORY is set in the ‘File Attributes’ button of the NtCreateFile tab in filetest and turns up in Data->Iopb->Parameters.Create
  • FILE_TRUNCATE_IF is set in CreateDisposition and turns up in Data->Iopb->Parameters.Options >> 24.

Build an example filter. Set breakpoints. Exercise with FileTest while reading the document.

AFAIK the only decent training material is the (quite excellent) OSR course so enrol in that or teach yourself - and expect that the shortest time that it will take will be 6 months with a course of 12 without.

I beg you pardon - I was working from away from the sources. When I said FILE_TRUNCATE_IF I actually means FILE_OVERWRITE_IF