The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm writing a security minifilter that uses a combination of kernel space and user space processing to decide whether a user should have access to a file or not, and fortunately it's been decided I only need to do this expensive processing once per file per user session. This means I can cache the allow/deny results on a per-file basis, and my first thought was to implement a simple least-recently-used (LRU) cache using a hashtable/doubly linked list containing each file's name in UNICODE_STRING format. However I thought I'd check with experts to see if there's a "minifilter-approved" way of doing something like this, after seeing what a timesaver minifilter communication ports are over other KM-UM communication options like WinSock.
Any suggestions appreciated including "that's a really bad idea"!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Kernel Debugging||16-20 October 2023||Live, Online|
|Developing Minifilters||13-17 November 2023||Live, Online|
|Internals & Software Drivers||4-8 Dec 2023||Live, Online|
|Writing WDF Drivers||10-14 July 2023||Live, Online|