Hello,
I have written a filter driver based on DDK filespy sample, that intercepts
write attempts to removable media by reparsing IRP_MJ_CREATE. When
redirected file is copied to a quarantine location, my program inspects it
after IRP_MJ_CLEANUP passed through my completion routine. After
inspection, I am impersonating an original thread and copy file using filter’s
system thread to avoid reentrancy.
My quarantine directory is located on a fixed hard drive; removable media is
a USB token.
During a file copy when my filter calls a ZwCreateFile with a name that
resized on USB token with, the call never returns. That is my filter sees
IRP_MJ_CREATE sees the call, and it passes it down using IoCallDriver, but
control is not returned to ZwCreateFile.
There is no blues screen of total system crash, but the process is stuck,
after a few successful copies (usually up to 4-5).
Sometimes, however, the same code works for the same file without problems.
I’ve also tried not to impersonate the original thread, just use a system
thread created by DeviceIoControl, but still see the same behavior. The
same problem is reproducible if I use copy to network drive instead of
removable media
What could be causing it?
Thank you,
Yury