Cancelling All the I/O Request From the Externel Devices

Dear all…

could anyone of you say or give me some guidelines how to cancel an IO Operation in PreOperation callback function of the minifilter?..

Is it possible to cancel an IRP in PreoperationCallBack() routine if so please me how to do it…
if possible give me some source code…

Thanks a lot in advance

Well, do you want to cancel it or to fail it ? All you need to do is complete the operation with the appropriate code:

Data->IoStatus.Status = STATUS_CANCELLED; // or set the appropriate NTSTATUS here
Data->IoStatus.Information = 0;

return FLT_PREOP_COMPLETE;

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

I tried that…

Here is my code for the preoperation call back routine…

FLT_PREOP_CALLBACK_STATUS
DBPreOperationCallBack(
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)

{

// FLT_VOLUME_PROPERTIES volumeProperties;

// ULONG returnedLength;

// NTSTATUS status = FltGetVolumeProperties(FltObjects->Volume,&volumeProperties,sizeof(FLT_VOLUME_PROPERTIES),&returnedLength);

UNREFERENCED_PARAMETER( FltObjects );

UNREFERENCED_PARAMETER( CompletionContext );

PAGED_CODE();

DB_DBG_PRINT( DBG_TRACE_ROUTINES ,(“DeviceBlocker!DBPreOperationDeviceBlocker: Entered\n”) );

//Data->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST ;

Data->IoStatus.Status = STATUS_CANCELLED;

Data->IoStatus.Information = 0;

//return FLT_PREOP_SUCCESS_WITH_CALLBACK;

return FLT_PREOP_COMPLETE;

//return FLT_PREOP_SUCCESS_NO_CALLBACK;

}

But it is not doing what i wanted… I have register this filter for IRP_MJ_CREATE,IRP_MJ_READ,IRP_MJ_WRITE operations

After loading this filter i am able to create, copy and paste files…but what i want is to block all these operations…