>I’ve seen the description on web page .I want to know how I can hook any
device(Do you add a filter driver upper this
device??)
If I would add filter driver via calls to IoAttachDevice and etc… I could
not intercept calls to already opened devices (before my driver loaded),
classic filter drivers approach did not fit my needs. I locate DRIVER_OBJECT
instead and modify it’s dispatch table (and FastIO) directly. Btw, the same
idea used in winternals TCP monitoring activity utility…
and where I can get the undocument API description ?
There are good books “Undocumented Windows NT” (by Prasad Dabak and etc…),
“NT Native API reference” and etc… Or aternatevely request MS for Native
SDK ;)).
BR,
Vadim
-----Original Message-----
Some description given on the web-page, if you ask more concrete question
(what actually you interest) I can try to answer it…
BR,
Vadim
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Crasher
Sent: Wednesday, November 14, 2001 1:38 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Device filter tool
A very good tool! But how it works?
???
>Hello, All!
>
>Probably this tool will be interesting for some of you. Now all drivers
and
>devices listed and FastIO also intercepted.
>
>http://www.ntndis.com/utilities/devfilter.htm
>
>BR,
>
>Vadim
>
>
>—
>You are currently subscribed to ntdev as: guodongzi@163.net
>To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
= = = = = = = = = = = = = = = = = = = =
Crasher
guodongzi@163.net
2001-11-14
You are currently subscribed to ntdev as: guodongzi@163.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
= = = = = = = = = = = = = = = = = = = =
Crasher
guodongzi@163.net
2001-11-14
b???v?j??jr???ޱ??i?Z?G?j)m?W???u???^U?-??+
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com