Minifilter driver not blocking file edition

NTFSD
1

I am trying to create a File System Filter (Minifilter) driver. For that I am following the tutorial provided here: https://www.youtube.com/watch?v=ukUf3kSSTOU

In a brief way, in the tutorial you create a minifilter driver that stops you from writing into a file called OPENME.txt.

I managed to install the driver and start it successfully, but I am still able to edit the file. When I check debug messages in the DebugView I can’t see any of my debug messages.

I have created a post is SO with my code and problem in detail. Could anyone help me out and tell me what am I doing wrong or how can I try to fin the problem?

https://stackoverflow.com/questions/48466308/minifilter-driver-not-blocking-file-edition

Thanks in advance.

2

Hey Alex,
I have answered your question on stack overflow since there you also posted some code.
You will have to make quite a bit of progress in first understanding windows kernel basics and minifilter basics.
I have made a few suggestions there for you and provided a few helpful links from Microsoft.
Hope this will help.

Gabriel
www.kasardia.com

3

I decided to follow your advice and started from scratch, following the nullFilter example provided in the Microsoft minifilter samples. Managed to get a minimalist example working, so I am going to start from here.

Thank you for the help.