I still plan to move to the filter manager and a minidriver, but I’ve decided it’ll have to wait until after my demo.
Too much to learn too fast.
Anyway, the IFS kit has two “legacy” drivers. The “smaller” one, has this in it:
//
// VERSION NOTE:
//
// There are 6 FastIO routines for which file system filters are bypassed as
// the requests are passed directly to the base file system. These 6 routines
// are AcquireFileForNtCreateSection, ReleaseFileForNtCreateSection,
// AcquireForModWrite, ReleaseForModWrite, AcquireForCcFlush, and
// ReleaseForCcFlush.
//
// In Windows XP and later, the FsFilter callbacks were introduced to allow
// filters to safely hook these operations. See the IFS Kit documentation for
// more details on how these new interfaces work.
//
// MULTIVERSION NOTE:
//
// If built for Windows XP or later, this driver is built to run on
// multiple versions. When this is the case, we will test
// for the presence of FsFilter callbacks registration API. If we have it,
// then we will register for those callbacks, otherwise, we will not.
//
#if WINVER >= 0x0501
{
FS_FILTER_CALLBACKS fsFilterCallbacks;
if (NULL != gRRDynamicFunctions.RegisterFileSystemFilterCallbacks) {
//
// Setup the callbacks for the operations we receive through
// the FsFilter interface.
//
// NOTE: You only need to register for those routines you really
// need to handle. SFilter is registering for all routines
// simply to give an example of how it is done.
//
fsFilterCallbacks.SizeOfFsFilterCallbacks = sizeof( FS_FILTER_CALLBACKS );
fsFilterCallbacks.PreAcquireForSectionSynchronization = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForSectionSynchronization = RRPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForSectionSynchronization = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForSectionSynchronization = RRPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForCcFlush = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForCcFlush = RRPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForCcFlush = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForCcFlush = RRPostFsFilterPassThrough;
fsFilterCallbacks.PreAcquireForModifiedPageWriter = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostAcquireForModifiedPageWriter = RRPostFsFilterPassThrough;
fsFilterCallbacks.PreReleaseForModifiedPageWriter = RRPreFsFilterPassThrough;
fsFilterCallbacks.PostReleaseForModifiedPageWriter = RRPostFsFilterPassThrough;
status = (gRRDynamicFunctions.RegisterFileSystemFilterCallbacks)( DriverObject,
&fsFilterCallbacks );
if (!NT_SUCCESS( status )) {
DriverObject->FastIoDispatch = NULL;
ExFreePoolWithTag( fastIoDispatch, RRLT_POOL_TAG_FASTIO );
IoDeleteDevice( gRRFilterControlDeviceObject );
return status;
}
}
}
is this what you’re talking about concerning how the file system will do stuff without passing down an IRP that I can trap?
is this the way to capture notepad?
What did you mean by using a FCB in conjunction with the FILE_OBJECT->FsContext1? I understand each file is uniquely defined by FsContext1, but I don’t understand anything about FCB’s and how they relate.
Thanks.