Some thing about the LOCATION of filefilter?

NTDEV
1

Hello all,

As we have known, we can build a fileFilter over file system by
IoAttachDeviceToDeviceStack, IoGetDeviceObjectPointer.

But how can I build a filefilter driver under file system? I find Norton
AntiVirus does it!

Any sense about this puzzle?

Anthony

2

Well certainly you can filter partition devices. You need to correlate
partitions to volumes, and you may need to understand FS layout and
metadata, but it can be done. What is it that you are trying to do that you
think can best be done by filtering below the FS?

=====================
Mark Roddy

-----Original Message-----
From: Anthony [mailto:xxxxx@hotmail.com]
Sent: Wednesday, February 11, 2004 10:01 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Some thing about the LOCATION of filefilter?

Hello all,

As we have known, we can build a fileFilter over file
system by IoAttachDeviceToDeviceStack, IoGetDeviceObjectPointer.

But how can I build a filefilter driver under file system?
I find Norton AntiVirus does it!

Any sense about this puzzle?

Anthony

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@stratus.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

3

Hi mark,

By Device Tool( a tool of DDK), you can find Norton AntiVirus builds a
device under FS(just look \Driver\Ftdisk). I believe it must be achieved by
other ways rather than oAttachDeviceToDeviceStack.

I just wonder about this technology.

Any more suggestion is welcome.

Anthony

“Roddy, Mark” дÈëÓʼþ news:xxxxx@ntdev…
> Well certainly you can filter partition devices. You need to correlate
> partitions to volumes, and you may need to understand FS layout and
> metadata, but it can be done. What is it that you are trying to do that
you
> think can best be done by filtering below the FS?
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: Anthony [mailto:xxxxx@hotmail.com]
> > Sent: Wednesday, February 11, 2004 10:01 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] Some thing about the LOCATION of filefilter?
> >
> > Hello all,
> >
> > As we have known, we can build a fileFilter over file
> > system by IoAttachDeviceToDeviceStack, IoGetDeviceObjectPointer.
> >
> > But how can I build a filefilter driver under file system?
> > I find Norton AntiVirus does it!
> >
> > Any sense about this puzzle?
> >
> > Anthony
> >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@stratus.com To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>

4

Yes and norton is attached to ftdisk’s volume device, not directly below the
file system. This is a standard filesystem filter, sitting on top of the
volume device objects for each filesytem of interest. If you go purchase the
IFS kit from microsoft, this is all fairly clearly explained, plus you get
samples that illustrate in software how to do this.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Anthony
Sent: Thursday, February 12, 2004 8:08 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Some thing about the LOCATION of filefilter?

Hi mark,

By Device Tool( a tool of DDK), you can find Norton
AntiVirus builds a device under FS(just look \Driver\Ftdisk).
I believe it must be achieved by other ways rather than
oAttachDeviceToDeviceStack.

I just wonder about this technology.

Any more suggestion is welcome.

Anthony

“Roddy, Mark” д???ʼ? news:xxxxx@ntdev…
> > Well certainly you can filter partition devices. You need
> to correlate
> > partitions to volumes, and you may need to understand FS layout and
> > metadata, but it can be done. What is it that you are trying to do
> > that
> you
> > think can best be done by filtering below the FS?
> >
> >
> > =====================
> > Mark Roddy
> >
> >
> > > -----Original Message-----
> > > From: Anthony [mailto:xxxxx@hotmail.com]
> > > Sent: Wednesday, February 11, 2004 10:01 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: [ntdev] Some thing about the LOCATION of filefilter?
> > >
> > > Hello all,
> > >
> > > As we have known, we can build a fileFilter over file system by
> > > IoAttachDeviceToDeviceStack, IoGetDeviceObjectPointer.
> > >
> > > But how can I build a filefilter driver under file system?
> > > I find Norton AntiVirus does it!
> > >
> > > Any sense about this puzzle?
> > >
> > > Anthony
> > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > > xxxxx@stratus.com To unsubscribe send a blank email to
> > > xxxxx@lists.osr.com
> > >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@hollistech.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>