Block openning file

NTFSD
1

hi

I am trying to do a minifilter that bloks openning files.
Could anyone explain it to me? How can I interrupt the IRP_MJ_READ for
desired file?
Or can anyone point me to an example?

thanks

2

>I am trying to do a minifilter that bloks openning files.

you will have to handle IRP_MJ_CREATE to achieve this.

On Tue, Mar 22, 2011 at 1:20 PM, Michal Pandoščák <
xxxxx@gmail.com> wrote:

hi

I am trying to do a minifilter that bloks openning files.
Could anyone explain it to me? How can I interrupt the IRP_MJ_READ for
desired file?
Or can anyone point me to an example?

thanks
— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List
Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–

  • amitr0
3

Monitor IRP_MJ_CREATE requests and you can block file-open from
pre-operation callback:

Data->IoStatus.Status = STATUS_ACCESS_DENIED;

Data->IoStatus.Information = 0L;

return FLT_PREOP_COMPLETE;

or from post-operation callback:

Data->IoStatus.Status = STATUS_ACCESS_DENIED;

Data->IoStatus.Information = 0L;

FltCancelFileOpen( fltObjects->Instance,
fltObjects->FileObject );

return FLT_POSTOP_FINISHED_PROCESSING;

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Pando?c?k
Sent: Tuesday, March 22, 2011 8:51 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Block openning file

hi

I am trying to do a minifilter that bloks openning files.

Could anyone explain it to me? How can I interrupt the IRP_MJ_READ for
desired file?

Or can anyone point me to an example?

thanks

— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List
Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer