Mini-Filter Driver for Process Monitoring?

NTDEV
1

Hello All,

I am trying to implement a process monitor for all versions of Windows OS. I started with the kernel patching method earlier which worked on 32bit version of windows. This method fails on the 64 bit version as kernel patching is not allowed anymore.
Then I read that on 64 bit platform the way to go is using a mini-filter driver. From the WDK (6000), I tried the PassThrough sample which has a neat implementation of the Pre and Post Callback function routine.

  1. Will this be the right way to achieve the target?
  2. Also, in this sample which IRP would be the most appropriate to monitor?
    (Currently I am looking at IRP_MJ_QUERY_INFORMATION)
  3. How can I block any process to be created in the PreOperation Callback routine?

I would really appreciate any help regarding this.

Thank you,
Kevin

2

xxxxx@gmail.com wrote:

Comments inline:

Hello All,

I am trying to implement a process monitor for all versions of Windows OS. I started with the kernel patching method earlier which worked on 32bit version of windows. This method fails on the 64 bit version as kernel patching is not allowed anymore.
Then I read that on 64 bit platform the way to go is using a mini-filter driver.
I wouldn’t just say 64bit, I’d say windows 2k sp4 and up… (with urp1).
From the WDK (6000), I tried the PassThrough sample which has a neat implementation of the Pre and Post Callback function routine.

  1. Will this be the right way to achieve the target?

Yes, but I think the ‘scanner’ sample is more useful in many ways.
(basics of contexts, blocking file access, user/kernel comm)

  1. Also, in this sample which IRP would be the most appropriate to monitor?
    (Currently I am looking at IRP_MJ_QUERY_INFORMATION)

I’m not sure why you chose this particular IRP, IRP_MJ_CREATE will be
adequate.

  1. How can I block any process to be created in the PreOperation Callback routine?

You shouldn’t try that here, in precreate you don’t even know if the
file (exe) exist on disk or not. Post create allows you
to block just as well; look to the minifilter scanner example for
details on how to block a file from opening
via access denied.

I would really appreciate any help regarding this.

Thank you,
Kevin

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

This is exactly what I was looking for!

Thank you Matt!