CODEWITHSUNDEEP
c++driverminifilterwindows-kernelkernel-mode
GSP
GSP

Reputation: 584

Minifilter redirect file creation in pre operation?

I am trying to redirect file creation on a volume of hard disk (i.e \Device\HarddiskVolume2)

I found redirecting file name in minifilter open pre. But I got a system dialog as below

enter image description here

Here is my code:

// I tested with pFileName = &Data->Iopb->TargetFileObject->FileName;
// It has same result
pFileName = &FltObjects->FileObject->FileName;
if (pFileName->Buffer != NULL)
    ExFreePool(pFileName->Buffer);

// gRedirectFullFilePath is \\Device\\HarddiskVolume2\\File.ext
pFileName->Length = gRedirectFullFilePath.Length;
pFileName->MaximumLength = pFileName->Length;
pFileName->Buffer = (PWCH) ExAllocatePool(NonPagedPool, pFileName->MaximumLength);
if (pFileName->Buffer == NULL)
    goto PreOperationCleanup;

RtlCopyUnicodeString(pFileName, &gRedirectFullFilePath);

// Change I/O status
Data->IoStatus.Information = IO_REPARSE;
Data->IoStatus.Status = STATUS_REPARSE;
Data->Iopb->TargetFileObject->RelatedFileObject = NULL;

FltSetCallbackDataDirty(Data);

return FLT_PREOP_COMPLETE;

I want this dialog to be not show. How should I do?

Thanks very much!

Upvotes: 2

Views: 1451

Answers (1)

ge0rdi
ge0rdi

Reputation: 281

You should check SimRep File System Minifilter Driver example from WDK8.1 samples.

For example it ignores volume opens (FO_VOLUME_OPEN) and directory opens (SL_OPEN_TARGET_DIRECTORY). Maybe that is causing troubles to you.
It also uses IoReplaceFileObjectName to replace name of a file object (should be safer than direct changing of FILE_OBJECT).

Upvotes: 1

Related Questions