redirecting knowndlls in filter drivers

NTFSD
1

Hi,

I am writing a filter driver where I want to redirect all opens for
exeuction of a file xxx.dll to yyy.dll.To do this, I change the
FileName in the Irp in MJ_CREATE.
1 st question : Is it the right way to do it or should I be generating
my own IRP’s?

When I do this I notice a problem in redirecting knowndlls. The moment
I do this to a knowndll xxx.dll, it is no longer being treated as a
knowndll. If I run winobj I can’t see the named section created for
this. This is my next question. Does smss.exe do some kind of
validation i.e. which file is backing this section and if it doesn’t
find the same filename; it doesn’t treat it as a knowndll?

Thanks

2

Replacing KnownDLLs is definitely a bad idea.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “foo bar”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, December 25, 2004 6:57 AM
Subject: [ntfsd] redirecting knowndlls in filter drivers

> Hi,
>
> I am writing a filter driver where I want to redirect all opens for
> exeuction of a file xxx.dll to yyy.dll.To do this, I change the
> FileName in the Irp in MJ_CREATE.
> 1 st question : Is it the right way to do it or should I be generating
> my own IRP’s?
>
> When I do this I notice a problem in redirecting knowndlls. The moment
> I do this to a knowndll xxx.dll, it is no longer being treated as a
> knowndll. If I run winobj I can’t see the named section created for
> this. This is my next question. Does smss.exe do some kind of
> validation i.e. which file is backing this section and if it doesn’t
> find the same filename; it doesn’t treat it as a knowndll?
>
> Thanks
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>