how to redirect use minifilter..

my purpose is when i openning the “calc.exe”,actually the true file opened is “notepad.exe”…

now i can do it when 2 EXEs in same part…
but if one in C:, the other one is D:,how should i do?

this is my code …

UNICODE_STRING* FileName,NewFileName;
PWCHAR FileNameBuffer = NULL;
RtlInitUnicodeString(&NewFileName,L"\WINDOWS\system32\notepad.exe");
FileName = &(Data->Iopb->TargetFileObject->FileName);//&(FileObject->FileName);
FileNameBuffer = (PWCHAR)ExAllocatePool(NonPagedPool, NewFileName.MaximumLength);
if (FileNameBuffer == NULL)
{
Data->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
Data->IoStatus.Information = 0;
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
ExFreePool( FileName->Buffer );
FileName->Buffer = FileNameBuffer;
FileName->MaximumLength = NewFileName.MaximumLength;
RtlCopyUnicodeString( FileName, &NewFileName );
FltSetCallbackDataDirty(Data);

please look at simrep WDK sample
you also need to implement GenerateNameCallback routine (see
FLT_REGISTRATION structure)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of galaxy.chen@qq.com
Sent: Friday, July 22, 2011 8:51 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] how to redirect use minifilter…

my purpose is when i openning the “calc.exe”,actually the true file opened
is “notepad.exe”…

now i can do it when 2 EXEs in same part…
but if one in C:, the other one is D:,how should i do?

this is my code …

UNICODE_STRING* FileName,NewFileName;
PWCHAR FileNameBuffer = NULL;
RtlInitUnicodeString(&NewFileName,L"\WINDOWS\system32\notepad.exe");
FileName =
&(Data->Iopb->TargetFileObject->FileName);//&(FileObject->FileName);
FileNameBuffer = (PWCHAR)ExAllocatePool(NonPagedPool,
NewFileName.MaximumLength);
if (FileNameBuffer == NULL)
{
Data->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
Data->IoStatus.Information = 0;
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
ExFreePool( FileName->Buffer );
FileName->Buffer = FileNameBuffer;
FileName->MaximumLength = NewFileName.MaximumLength;
RtlCopyUnicodeString( FileName, &NewFileName );
FltSetCallbackDataDirty(Data);


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

thanks a lot…