Hi,
Introduction:
*********************
I am writing a filter driver based on the FileSpy sample provided with the IFS Kit, My current filter is based of FileSpy and I am trying to switch to the sFilter sample as I don’t need all of the functionality introduced by FileSpy.
Problem description:
*********************
Using FileSpy I get indication for each file creation through IRP_MJ_CREATE ( of the appropriate FS device ).
Using the sFilter sample I don’t get such Indications…
Why don’t I get these indications using the sFilter sample? I have verified all of the FS device stack are being hooked to while sFilter is loading ( through the IoRegisterFsRegistartionChange API called by from the DriverEntry ).
I have compared sFitler relevant code with it’s FileSpy counterpart and didn’t find any meaningful difference… I guess I have missed something…
Any help comment or remark would be appreciated…
Naddav.
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com