How to write File System Filter Driver?

NTFSD
1

Hi All,

I am trying to write a FS filter driver that will notify when a file is opened, closed and written. Currently I am handeling only IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and all other IRP, I pass to next driver. But I dont know why it throw an exception after some time. Is there any issues that I must consider during driver writing?

Thanks & Regards,
Amit.

2

WINDDK\6000\src\filesys\miniFilter\scanner

It’s a good sample.

On Fri, 18 May 2007 03:09:32 -0400 (EDT), xxxxx@yahoo.com
wrote:

Hi All,

I am trying to write a FS filter driver that will notify when a file is opened, closed and written. Currently I am handeling only IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and all other IRP, I pass to next driver. But I dont know why it throw an exception after some time. Is there any issues that I must consider during driver writing?

Thanks & Regards,
Amit.

3

Hey there,

Without knowing what type of exception happened, I don’t think anyone
here will be able too help you. You haven’t provided
enough info.

Given how you worded your question I assume your writing a legacy
filter; you really should be building a minifilter
instead. If you were, you could modify just a few lines in the scanner
sample and do exactly what your wanting too do with
a lot less hassle. Just modify the struct that is passed to usermode to
hold a wchar and strip out the fltreadfile code and
replace that with a fltgetfilename (something along those lines)…

xxxxx@yahoo.com wrote:

Hi All,

I am trying to write a FS filter driver that will notify when a file is opened, closed and written. Currently I am handeling only IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and all other IRP, I pass to next driver. But I dont know why it throw an exception after some time. Is there any issues that I must consider during driver writing?

Thanks & Regards,
Amit.

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I am writing legacy driver. I have’t implimented fast IO interface. Is it a problem?

5

yes, you have too support everything the underlying driver does.

xxxxx@yahoo.com wrote:

I am writing legacy driver. I have’t implimented fast IO interface. Is it a problem?

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com