Hi all …
I have written a filesystem mini filter.
I have register filter for major function IRP_MJ_SET_SECURITY.
When request come to filter in precallback , i make a call to FltQuerySecurityObject(); which gives me previous securty descriptor before setting a new one. I write those security information as it is to a file on disk.
Then i restart machine , and another driver which read security information from file that is written by previous driver and set this security object to file to which it belongs.
But it gives me bugCheck " 0x24 "
Tell me whether this is a proper way to do so?
This is an assignment which is part of my project… Which restore file to previous state.
If this is not a proper way , then please guide me for a proper solution.
Thanks