CD Writing

NTFSD
1

Hi all,

I am awefully sorry for this repost, but I want to know how to prevent CD
writer softwares when they try to burn a disk.

There was more than one discussion recently, but for some reason (most
probably an incorrect search string), I am unable to find the threads.

I have the following queries:

  1. Where exactly do I attach my driver to tap these requests. Would
    attaching a lower filter to disk.sys do?
  2. I believe someone in this list told us about third party libraries that
    are used to make these softwares, unfortunately, my memory fails me, can
    someone through some light on these libraires again? How they fucntion, etc.
  3. Does the windowsxp/2k3 inbuilt burner (from roxio) use the same
    technique, or do they use the FS?
  4. Which all SRBs do I need to filter to detect a burn operation corectly?
  5. Is there a sample of a similar driver (that may not be CD write blocker),
    but that attaches itself to the same place where I need to attach myself, in
    any of the DDKs, IFS kits etc?

Thanks for your patience.

–

  • amitr0
2

The simplest way is to remove the CD writer from the computer. Other
than that, you would need to be looking at a disk or port filter because
CD writing is done directly to the device, not through the file system.
NTDEV is a better forum for questions like this, because this does not
relate to file systems.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006 (note new date - MS scheduled plugfest the
same week again.)

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of amitr0
Sent: Wednesday, February 22, 2006 6:12 AM
To: ntfsd redirect
Subject: [ntfsd] CD Writing

Hi all,

I am awefully sorry for this repost, but I want to know how to prevent
CD writer softwares when they try to burn a disk.

There was more than one discussion recently, but for some reason (most
probably an incorrect search string), I am unable to find the threads.

I have the following queries:

  1. Where exactly do I attach my driver to tap these requests. Would
    attaching a lower filter to disk.sys do?
  2. I believe someone in this list told us about third party libraries
    that are used to make these softwares, unfortunately, my memory fails
    me, can someone through some light on these libraires again? How they
    fucntion, etc.
  3. Does the windowsxp/2k3 inbuilt burner (from roxio) use the same
    technique, or do they use the FS?
  4. Which all SRBs do I need to filter to detect a burn operation
    corectly?
  5. Is there a sample of a similar driver (that may not be CD write
    blocker), but that attaches itself to the same place where I need to
    attach myself, in any of the DDKs, IFS kits etc?

Thanks for your patience.

–

3

Amitr0,

This is the most recent discussion on this issue if I recall correctly.
http://www.osronline.com/showThread.cfm?link=84521

I didn’t re-read the thread, but I think this is what you were looking
for (only CD related thread I can think of in recent months)

M

amitr0 wrote:

Hi all,

I am awefully sorry for this repost, but I want to know how to prevent
CD writer softwares when they try to burn a disk.

There was more than one discussion recently, but for some reason (most
probably an incorrect search string), I am unable to find the threads.

I have the following queries:

  1. Where exactly do I attach my driver to tap these requests. Would
    attaching a lower filter to disk.sys do?
  2. I believe someone in this list told us about third party libraries
    that are used to make these softwares, unfortunately, my memory fails
    me, can someone through some light on these libraires again? How they
    fucntion, etc.
  3. Does the windowsxp/2k3 inbuilt burner (from roxio) use the same
    technique, or do they use the FS?
  4. Which all SRBs do I need to filter to detect a burn operation corectly?
  5. Is there a sample of a similar driver (that may not be CD write
    blocker), but that attaches itself to the same place where I need to
    attach myself, in any of the DDKs, IFS kits etc?

Thanks for your patience.

–

4

MM, Tony, thanks for the tips.

MM, this is the thread I was looking for…

5

>3. Does the windowsxp/2k3 inbuilt burner (from roxio) use the same

technique, or do they use the FS?

They are lower filter to CdRom.sys, and send SRBs directly to the storage port.

Some software sends the SRBs directly to storage port, bypassing the filters.
Such software can only be blocked by hooking or by disabling their drivers by
name.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

6

well, maxim,

reading your mails makes me think, a far cleaner approah of blocking these
operations, would be by specifyig ACLs for the software and preventing
certain users from installing/launching such apps.

amitr0

7

>operations, would be by specifyig ACLs for the software and preventing

certain users from installing/launching such apps.

Only admins can install such apps. So, just do not give the users the admin
rights.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com