Hi,
I am currently developing file system filter driver, for which, I have
mentioned requirement below in brief.
The requirement is to track the file for write operation AND
scan the file in real time if modified (by real time I mean blocking
close call) AND
report the right process name which actually modified the file (as
there could be the case of multiple processes writing to same file).
So I am planning to maintain bookkeeping of FSContext and FileObject
(1 to Many relationship, keyed on FsContext) from Create to Close calls
and mark the FileObject as WriteObserved if IRP_MJ_WRITE is observed
on that file object and initiate scanning in IRP_MJ_CLOSE call if
WriteObserved is true for
that FileObject.
Now considering the case of two applications opening the same file in
write mode
FSContext
FileObject1 -> filename, processname1
FileObject2 -> filename, processname2
and any / both application performs write operation simultaneously.
Now my biggest worry is, if I do not observe write operation with
either of the listed FileObjects, as could be the case of stream file
object used to back a section object for the memory manager (as mentioned
in OSR article: http://www.osronline.com/article.cfm?id=102)
AND
write operation is performed with the help of stream file object,
SO
how to relate the stream file object with the actual FileObject from
the list (FileObject1 / FileObject2), so that I can declare the right
process name which modified the file?
It would be great help for any pointers to this problem.
Thanks
Amit