Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Minifilter Driver - detecting IO operations initiated remotely to local shared folders
ilikewindowskernel
Member Posts: 6
hi OSR Community,
I wrote a minifilter driver for one of my projects and i want it to behave differently when handling requests locally vs remote requests
is there any function/flag/alignment that can help me differentiate whether a Write operation is from a local user writing to file or if someone is writing to a file inside a shared folder over SMB ?
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Internals & Software Drivers | 19-23 June 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
Comments
Do you mean whether the operation is from SRV? I'm pretty sure that there is a registry setting which causes SRV to garnish the requests with an ECP.
This might be it
this is an ECP you will get if you are the computer requesting a read from another computer
I'm trying to find the ECP that is given to the callback in the computer that is requested from (the computer that shared the folder)
Try this link and look for Christian's comment
thank you very much @rod_widdowson, it worked !