Hi,
From the IFS kit, I built the “scanner” minifilter. It runs fine
(I changed INF file settings: StartType = 1). But, now, I do not want
the user-mode. I want this scanner filter to be running when the PC
starts (I do not have to execute “scanuser.exe”) and when I open any
file, it must scan that file. In short, I am trying to segregate the
kernel-mode and user-mode code and somehow make the kernel-mode filter
work.
Any suggestions?
Thanks,
S.Srivathsan
DISCLAIMER:
This email (including any attachments) is intended for the sole use of the intended recipient/s and may contain material that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or distribution or forwarding of any or all of the contents in this message is STRICTLY PROHIBITED. If you are not the intended recipient, please contact the sender by email and delete all copies; your cooperation in this regard is appreciated.
Why don’t you just convert scanuser.exe to a system service then. There
is a pretty good example of creating a service in the SDK. If your
trying to merge the two together, the code in scanuser’s ScanBuffer
function can be copied to the ScannerpScanFileInUserMode in the filter,
just get rid of the fltSendMessage function. Of course there are other
minor changes you would need to make.
However, just make scanuser a service… That would be a lot safer and
easier to build upon.
m.
Srivathsan_Srinivasagopalan wrote:
Hi,
From the IFS kit, I built the “scanner” minifilter. It runs fine (I
changed INF file settings: StartType = 1). But, now, I do not want the
user-mode. I want this scanner filter to be running when the PC starts
(I do not have to execute “scanuser.exe”) and when I open any file, it
must scan that file. In short, I am trying to segregate the
kernel-mode and user-mode code and somehow make the kernel-mode filter
work.
Any suggestions?
Thanks,
S.Srivathsan
DISCLAIMER:
This email (including any attachments) is intended for the sole use of
the intended recipient/s and may contain material that is CONFIDENTIAL
AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or
copying or distribution or forwarding of any or all of the contents in
this message is STRICTLY PROHIBITED. If you are not the intended
recipient, please contact the sender by email and delete all copies;
your cooperation in this regard is appreciated…
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com