Hi,
I want to write a driver that monitors all the activity to and from the system. Actually what I want to do is to track all the writes on any files. I have referred the FileMon application (and source) from sysinternals, it helped me a lot in achieving what I want, but it only provides the file’s starting offset, I also wants the block number of the file on the disk that has been written/modified.
Also I wants the disk starting offset, is it possible to obtain the disk’s starting offset in a file system driver?
I also referred the diskperf’s source code but its totally meant for disk, it does not know anything about the file name and path that are being accessed or written.
Below is my code snippet, can some one help me out.
Thanks in advance.
////////////////////////DriverMain.c//////////////////////////////////////
//////////////////////////////////////////////////////////////////////////
// DriverEntry - Entry point of the driver
NTSTATUS DriverEntry(
__inout PDRIVER_OBJECT DriverObject,
__in PUNICODE_STRING RegistryPath
)
{
NTSTATUS status = STATUS_SUCCESS;
ULONG i = 0;
//ASSERT(FALSE); // This will break to debugger
//
// Store our driver object.
//
g_fsFilterDriverObject = DriverObject;
//
// Initialize the driver object dispatch table.
//
for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; ++i)
{
DriverObject->MajorFunction[i] = MyFilterDispatchPassThrough;
}
DriverObject->MajorFunction[IRP_MJ_WRITE] = MyFilterDispatchWrite;
//
// Set fast-io dispatch table.
//
DriverObject->FastIoDispatch = &g_fastIoDispatch;
//
// Registered callback routine for file system changes.
//
status = IoRegisterMyRegistrationChange(DriverObject, MyFilterNotificationCallback);
if (!NT_SUCCESS(status))
{
return status;
}
//
// Set driver unload routine (debug purpose only).
//
DriverObject->DriverUnload = MyFilterUnload;
return STATUS_SUCCESS;
}
//////////////////////////////////////////////////////////////////////////
// Unload routine
VOID MyFilterUnload(
__in PDRIVER_OBJECT DriverObject
)
{
ULONG numDevices = 0;
ULONG i = 0;
LARGE_INTEGER interval;
PDEVICE_OBJECT devList[DEVOBJ_LIST_SIZE];
interval.QuadPart = (5 * DELAY_ONE_SECOND); //delay 5 seconds
//
// Unregistered callback routine for file system changes.
//
IoUnregisterMyRegistrationChange(DriverObject, MyFilterNotificationCallback);
//
// This is the loop that will go through all of the devices we are attached
// to and detach from them.
//
for (;
{
IoEnumerateDeviceObjectList(
DriverObject,
devList,
sizeof(devList),
&numDevices);
if (0 == numDevices)
{
break;
}
numDevices = min(numDevices, RTL_NUMBER_OF(devList));
for (i = 0; i < numDevices; ++i)
{
MyFilterDetachFromDevice(devList[i]);
ObDereferenceObject(devList[i]);
}
KeDelayExecutionThread(KernelMode, FALSE, &interval);
}
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////IrpDispatch.c//////////////////////////////////////////////
#include “MyFilter.h”
#include “stdarg.h”
#include “stdio.h”
#include “windef.h”
#define MAXPATHLEN 1024
///////////////////////////////////////////////////////////////////////////////////////////////////
// PassThrough IRP Handler
NTSTATUS MyFilterDispatchPassThrough(
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
{
PFSFILTER_DEVICE_EXTENSION pDevExt = (PMYFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// IRP_MJ_WRITE IRP Handler
NTSTATUS MyFilterDispatchWrite(
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
{
PIO_STACK_LOCATION currentIrpStack = IoGetCurrentIrpStackLocation(Irp);
PFILE_OBJECT pFileObject = currentIrpStack->FileObject;
PUNICODE_STRING name;
PWSTR aname;
name = &pFileObject->FileName;
aname = name->Buffer;
DbgPrint(“File: %ws Offset: %d Length: %d”, aname, currentIrpStack->Parameters.Write.ByteOffset.LowPart, currentIrpStack->Parameters.Write.Length);
return MyFilterDispatchPassThrough(DeviceObject, Irp);
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////Notification.c//////////////////////////////////////////////////////////////////
#include “MyFilter.h”
//////////////////////////////////////////////////////////////////////////
// Prototypes
NTSTATUS MyFilterAttachToFileSystemDevice(
__in PDEVICE_OBJECT DeviceObject
);
VOID MyFilterDetachFromFileSystemDevice(
__in PDEVICE_OBJECT DeviceObject
);
NTSTATUS MyFilterEnumerateFileSystemVolumes(
__in PDEVICE_OBJECT DeviceObject
);
///////////////////////////////////////////////////////////////////////////////////////////////////
// This routine is invoked whenever a file system has either registered or
// unregistered itself as an active file system.
VOID MyFilterNotificationCallback(
__in PDEVICE_OBJECT DeviceObject,
__in BOOLEAN MyActive
)
{
//
// Handle attaching/detaching from the given file system.
//
if (MyActive)
{
MyFilterAttachToFileSystemDevice(DeviceObject);
}
else
{
MyFilterDetachFromFileSystemDevice(DeviceObject);
}
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// This will attach to the given file system device object
NTSTATUS MyFilterAttachToFileSystemDevice(
__in PDEVICE_OBJECT DeviceObject
)
{
NTSTATUS status = STATUS_SUCCESS;
PDEVICE_OBJECT filterDeviceObject = NULL;
if (!MyFilterIsAttachedToDevice(DeviceObject))
{
status = MyFilterAttachToDevice(DeviceObject, &filterDeviceObject);
if (!NT_SUCCESS(status))
{
return status;
}
//
// Enumerate all the mounted devices that currently exist for this file system and attach to them.
//
status = MyFilterEnumerateFileSystemVolumes(DeviceObject);
if (!NT_SUCCESS(status))
{
MyFilterDetachFromDevice(filterDeviceObject);
return status;
}
}
return STATUS_SUCCESS;
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// This will detach us from the chain
VOID MyFilterDetachFromFileSystemDevice(
__in PDEVICE_OBJECT DeviceObject
)
{
PDEVICE_OBJECT device = NULL;
for (device = DeviceObject->AttachedDevice; NULL != device; device = device->AttachedDevice)
{
if (MyFilterIsMyDeviceObject(device))
{
//
// Detach us from the object just below us. Cleanup and delete the object.
//
MyFilterDetachFromDevice(device);
break;
}
}
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// Enumerate all the mounted devices that currently exist for the given file
// system and attach to them
NTSTATUS MyFilterEnumerateFileSystemVolumes(
__in PDEVICE_OBJECT DeviceObject
)
{
NTSTATUS status = STATUS_SUCCESS;
ULONG numDevices = 0;
ULONG i = 0;
PDEVICE_OBJECT devList[DEVOBJ_LIST_SIZE];
//
// Now get the list of devices.
//
status = IoEnumerateDeviceObjectList(
DeviceObject->DriverObject,
devList,
sizeof(devList),
&numDevices);
if (!NT_SUCCESS(status))
{
return status;
}
numDevices = min(numDevices, RTL_NUMBER_OF(devList));
//
// Walk the given list of devices and attach to them if we should.
//
for (i = 0; i < numDevices; ++i)
{
//
// Do not attach if:
// - This is the control device object (the one passed in)
// - The device type does not match
// - We are already attached to it.
//
if (devList[i] != DeviceObject &&
devList[i]->DeviceType == DeviceObject->DeviceType &&
!MyFilterIsAttachedToDevice(devList[i]))
{
status = MyFilterAttachToDevice(devList[i], NULL);
}
ObDereferenceObject(devList[i]);
}
return STATUS_SUCCESS;
}
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////AttachDetach.c////////////////////////////////////////////////////////////
#include “MyFilter.h”
///////////////////////////////////////////////////////////////////////////////////////////////////
// This will attach to a DeviceObject that represents a mounted volume
NTSTATUS MyFilterAttachToDevice(
__in PDEVICE_OBJECT DeviceObject,
__out_opt PDEVICE_OBJECT* pFilterDeviceObject
)
{
NTSTATUS status = STATUS_SUCCESS;
PDEVICE_OBJECT filterDeviceObject = NULL;
PFSFILTER_DEVICE_EXTENSION pDevExt = NULL;
ULONG i = 0;
ASSERT(!MyFilterIsAttachedToDevice(DeviceObject));
//
// Create a new device object we can attach with.
//
status = IoCreateDevice(
g_fsFilterDriverObject,
sizeof(FSFILTER_DEVICE_EXTENSION),
NULL,
FILE_DEVICE_DISK,
0,
FALSE,
&filterDeviceObject);
if (!NT_SUCCESS(status))
{
return status;
}
pDevExt = (PFSFILTER_DEVICE_EXTENSION)filterDeviceObject->DeviceExtension;
//
// Propagate flags from Device Object we are trying to attach to.
//
if (FlagOn(DeviceObject->Flags, DO_BUFFERED_IO))
{
SetFlag(filterDeviceObject->Flags, DO_BUFFERED_IO);
}
if (FlagOn(DeviceObject->Flags, DO_DIRECT_IO))
{
SetFlag(filterDeviceObject->Flags, DO_DIRECT_IO);
}
if (FlagOn(DeviceObject->Characteristics, FILE_DEVICE_SECURE_OPEN))
{
SetFlag(filterDeviceObject->Characteristics, FILE_DEVICE_SECURE_OPEN);
}
//
// Do the attachment.
//
// It is possible for this attachment request to fail because this device
// object has not finished initializing. This can occur if this filter
// loaded just as this volume was being mounted.
//
for (i = 0; i < 8; ++i)
{
LARGE_INTEGER interval;
status = IoAttachDeviceToDeviceStackSafe(
filterDeviceObject,
DeviceObject,
&pDevExt->AttachedToDeviceObject);
if (NT_SUCCESS(status))
{
break;
}
//
// Delay, giving the device object a chance to finish its
// initialization so we can try again.
//
interval.QuadPart = (500 * DELAY_ONE_MILLISECOND);
KeDelayExecutionThread(KernelMode, FALSE, &interval);
}
if (!NT_SUCCESS(status))
{
//
// Clean up.
//
IoDeleteDevice(filterDeviceObject);
filterDeviceObject = NULL;
}
else
{
//
// Mark we are done initializing.
//
ClearFlag(filterDeviceObject->Flags, DO_DEVICE_INITIALIZING);
if (NULL != pFilterDeviceObject)
{
*pFilterDeviceObject = filterDeviceObject;
}
}
return status;
}
void MyFilterDetachFromDevice(
__in PDEVICE_OBJECT DeviceObject
)
{
PFSFILTER_DEVICE_EXTENSION pDevExt = (PFSFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;
IoDetachDevice(pDevExt->AttachedToDeviceObject);
IoDeleteDevice(DeviceObject);
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// This determines whether we are attached to the given device
BOOLEAN MyFilterIsAttachedToDevice(
__in PDEVICE_OBJECT DeviceObject
)
{
PDEVICE_OBJECT nextDevObj = NULL;
PDEVICE_OBJECT currentDevObj = IoGetAttachedDeviceReference(DeviceObject);
//
// Scan down the list to find our device object.
//
do
{
if (MyFilterIsMyDeviceObject(currentDevObj))
{
ObDereferenceObject(currentDevObj);
return TRUE;
}
//
// Get the next attached object.
//
nextDevObj = IoGetLowerDeviceObject(currentDevObj);
//
// Dereference our current device object, before moving to the next one.
//
ObDereferenceObject(currentDevObj);
currentDevObj = nextDevObj;
} while (NULL != currentDevObj);
return FALSE;
}