please somebody help me. please i need my filter driver to work. I working on it for over a month. I have read every msdn article and seen other samples but i cant understand. My English is weak. The code below is giving me BSOD page fault. Please help me. And also i will be very thankful if you define or provide a simple and easy definitions.
#include “MyDriver.h”
PDEVICE_OBJECT gDeviceObject;
PDRIVER_OBJECT gDriverObject;
FAST_IO_DISPATCH g_fastIoDispatch =
{
sizeof(FAST_IO_DISPATCH),
FsFilterFastIoCheckIfPossible,
FsFilterFastIoRead,
FsFilterFastIoWrite,
FsFilterFastIoQueryBasicInfo,
FsFilterFastIoQueryStandardInfo,
FsFilterFastIoLock,
FsFilterFastIoUnlockSingle,
FsFilterFastIoUnlockAll,
FsFilterFastIoUnlockAllByKey,
FsFilterFastIoDeviceControl,
FsFilterFastIoDetachDevice,
FsFilterFastIoQueryNetworkOpenInfo,
FsFilterFastIoMdlRead,
FsFilterFastIoMdlReadComplete,
FsFilterFastIoPrepareMdlWrite,
FsFilterFastIoMdlWriteComplete,
FsFilterFastIoReadCompressed,
FsFilterFastIoWriteCompressed,
FsFilterFastIoMdlReadCompleteCompressed,
FsFilterFastIoMdlWriteCompleteCompressed,
FsFilterFastIoQueryOpen
};
VOID Change(PDEVICE_OBJECT DeviceObject, BOOLEAN Active)
{
if (Active)
{
PDEVICE_EXTENSION dev;
PDEVICE_OBJECT newDevice;
NTSTATUS status;
status = IoCreateDevice(gDriverObject,
sizeof(DEVICE_EXTENSION),
NULL,
DeviceObject->DeviceType,
0,
FALSE,
&newDevice);
if (!NT_SUCCESS(status))
return status;
dev = ((PDEVICE_EXTENSION)newDevice->DeviceExtension);
if (FlagOn(DeviceObject->Flags, DO_BUFFERED_IO))
SetFlag(newDevice->Flags, DO_BUFFERED_IO);
if (FlagOn(DeviceObject->Flags, DO_DIRECT_IO))
SetFlag(newDevice->Flags, DO_DIRECT_IO);
if (FlagOn(DeviceObject->Flags, FILE_DEVICE_SECURE_OPEN))
SetFlag(DeviceObject->Flags, FILE_DEVICE_SECURE_OPEN);
status = IoAttachDeviceToDeviceStackSafe(newDevice,
DeviceObject,
dev->AttachedToDeviceObject
);
if (!NT_SUCCESS(status))
{
IoDeleteDevice(newDevice);
return status;
}
ClearFlag(newDevice->Flags, DO_DEVICE_INITIALIZING);
}
}
NTSTATUS DriverUnload( PDRIVER_OBJECT DriverObject)
{
IoDeleteDevice(gDeviceObject);
return STATUS_SUCCESS;
}
NTSTATUS MajorFunction( PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
DbgPrint(“Major Function”);
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(DeviceObject, Irp);
}
//NTSTATUS FsPreAcquireForSectionSynchronization(__in PFS_FILTER_CALLBACK_DATA Data, __out PVOID CompletionContext)
//{
// PFSRTL_ADVANCED_FCB_HEADER header = Data->FileObject->FsContext;
// DbgPrint(“AcquireForSectionSynchronization”);
//
// if (Data->Parameters.AcquireForSectionSynchronization.SyncType == SyncTypeCreateSection && Data->FileObject->ReadAccess)
// {
// ExAcquireResourceExclusiveLite()
// }
//}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
/*UNICODE_STRING DeviceName, DosDeviceName;
RtlInitUnicodeString(&DeviceName,L"\Device\Mydriver");
RtlInitUnicodeString(&DosDeviceName, L"\DosDevices\Mydriver");*/
DbgPrint(“Creating device Object”);
//KeDelayExecutionThread(KernelMode, FALSE, -1000000 * 3);
DriverObject->DriverUnload = DriverUnload;
NTSTATUS status;
status = IoCreateDevice(
DriverObject,
0,
NULL,
FILE_DEVICE_DISK_FILE_SYSTEM,
0,
FALSE,
&gDeviceObject
);
if (!NT_SUCCESS(status))
return status;
DbgPrint(“Creating Major Functions %wZ”, status);
// KeDelayExecutionThread(KernelMode, FALSE, -1000000 * 3);
//status = IoCreateSymbolicLink()
ULONG i = 0;
for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
DriverObject->MajorFunction[i] = MajorFunction;
DbgPrint(“Registering FastIo”);
//KeDelayExecutionThread(KernelMode, FALSE, -1000000 * 3);
DriverObject->FastIoDispatch = &g_fastIoDispatch;
DbgPrint(“registering callbacks”);
FS_FILTER_CALLBACKS fsFilterCallbacks;
fsFilterCallbacks.SizeOfFsFilterCallbacks = sizeof(FS_FILTER_CALLBACKS);
fsFilterCallbacks.PreAcquireForSectionSynchronization = NULL;
fsFilterCallbacks.PostAcquireForSectionSynchronization = NULL;
fsFilterCallbacks.PreReleaseForSectionSynchronization = NULL;
fsFilterCallbacks.PostReleaseForSectionSynchronization = NULL;
fsFilterCallbacks.PreAcquireForCcFlush = NULL;
fsFilterCallbacks.PostAcquireForCcFlush = NULL;
fsFilterCallbacks.PreReleaseForCcFlush = NULL;
fsFilterCallbacks.PostReleaseForCcFlush = NULL;
fsFilterCallbacks.PreAcquireForModifiedPageWriter = NULL;
fsFilterCallbacks.PostAcquireForModifiedPageWriter = NULL;
fsFilterCallbacks.PreReleaseForModifiedPageWriter = NULL;
fsFilterCallbacks.PostReleaseForModifiedPageWriter = NULL;
status = FsRtlRegisterFileSystemFilterCallbacks(DriverObject, &fsFilterCallbacks);
if (!NT_SUCCESS(status))
return status;
status = IoRegisterFsRegistrationChange(DriverObject, Change);
if (!NT_SUCCESS(status))
return status;
DbgPrint(“Callback routines”);
// KeDelayExecutionThread(KernelMode, FALSE, -1000000 * 3);
gDriverObject = DriverObject;
return STATUS_SUCCESS;
}
