Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Writing FileSystem Filter Driver. How to Start?

Posted on 2004-08-23
11
Medium Priority
?
2,246 Views
Last Modified: 2013-11-20
Hi Experts,
 I want to write a filter driver to intercept all the file IO requests.
 I also need to identify the invoking application, type of request, the target file requested.
 Using that, I want to block some applications to access some sensitive files.
 Can you tell me, How to/ From where to start? I am using VC++ 6 & WIndows 2000.
 I am also having DDK for Windows 2000. I am stuck at starting to write a simple device driver.
 Is there any way to develope such type of drivers portable to all Win32 Platforms?
 If providing any sample code along with documentation, it will help me more.
 Thanks.

 with regards,
 aravind.t
 
0
Comment
Question by:aravindtj
  • 6
  • 3
11 Comments
 
LVL 3

Author Comment

by:aravindtj
ID: 11893928
Here I get some basic info.

http://www.osronline.com/article.cfm?id=20

But, I dont want to use DDK.

How to do?
0
 
LVL 1

Expert Comment

by:rhodgson
ID: 11911202
To build a file system filter DRIVER you have to use the DDK.

A filter driver written for Windows 2000 will work on XP, but will not work on 95,98&ME.

Although you request sounds like a fairly trivial matter, in fact it is quite a complicated bit of code.
0
 
LVL 3

Author Comment

by:aravindtj
ID: 11912080
Hi Rhodgson,
  Thanks for your reply.
  I know that my requirement is complicated.
  But, I am newbie to driver development.
  So, I want to know about the Basic concepts in writing and testing Device drivers.
  Like, the driver I supposed to develope will display all the file system call like open, read, write of files.
  I know that the drivers are not compatible with Win NT and Win 9x systems. But, I refered KernalDriver tools website that they are providing drives compatible with all Windows platforms.

  If you have any simple, sample code in c++ to write a elementary device driver for win2k,
  it will help me a lot.

  I refered some books like, DDK documentation, WindowsNT File System Internals, Programming the Microsoft Windows Driver Model by Walt Oney, The Windows 2000 Device Driver Book, A Guide for Programmers, Second Edition by Art Baker,Jerry Lozano etc.
  But nowhere, I found how to start and from where to start?

Thanks in advance.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 1

Expert Comment

by:rhodgson
ID: 11912669
The KernalDriver tools that provide functionality for both NT and 95 versions include both a SYS driver and a VXD driver which have to be developed seperately.

Device Drivers are actually harder to write in C++ without additional tools, because C++ relies on the C runtime libraries which are not available in device drivers.  So you either have to build the C++ support functions, buy a library that does this, or stick with C for writing device drivers.

Template device drivers are available in the DDK samples folder, and Microsoft used to also provide an "IFS kit" to help you work with the filing system.  I havn't built any device drivers in quite some time so I am not completely up to date on what source Microsoft provide and where you would find it at the moment.

http://www.sysinternals.com provide "filemon" which probably does everything you are interested in and quite a lot more.  Again they used to provide source for this utility (I certainly have the source to v4.28), so perhaps that is available somewhere on the internet.

I would post example code in my reply, however device driver code is rather large, with the Microsoft sample filter driver shell stetching to over 3,000 lines of code (the file being called sfilter.c).


0
 
LVL 3

Author Comment

by:aravindtj
ID: 11914681
Hi Rhodgson,
  Thanks for your reply.
 I can't get the source code for "filemon" the www.sysinternals.com site. Can you send me the source code? It will be helpful, if send the sample code to me.
 I have one more doubt. How to test the driver after installing. ie, I installed a driver for monitoring file system calls. I a file is openned for writing, some notification like a message box must pop.
 How to do this?
 I am not having IFS now.And I have DDK.

Thanks in advance.

 
0
 
LVL 1

Expert Comment

by:rhodgson
ID: 11914842
Unfortunately the license clearly states I cannot distribute the source files, so if you can't find it on the sysinternals website then I guess it is no longer publicly available.  The IFS kit comes with a similiarly restrictive license.

To open a message box from a driver, you would normally run another process in user space, or the system account which checks the driver and then produces the message box when the driver returns a signal.

Like I said at in my first response to do what you are asking is far from a trivial piece of work.
0
 
LVL 3

Author Comment

by:aravindtj
ID: 11920890

Thanks lot Mr Rhodgson.

I developed a driver. And How can send the driver debug messages [like using DbgPrint(..,..)] directly to system Event Log. So, I can view the driver events using the Eventviewer. I can write events in eventlog for my applications by ReportEvent method. But is not working in driver programming.
 How to do this?

Thanks in advance.

0
 
LVL 3

Author Comment

by:aravindtj
ID: 11921082

Hi Mr Rhodgson,

 In the book "Windows NT Event Logging" by  James D. Murray,   http://www.oreilly.com/catalog/winlog/chapter/ch02.html  I learn that I cann't access the Event Logging API for the Kernal mode programs like Drivers. It is foronly user applications.

 I also says that we can only access that service through the I/O Manager.

 How to do that?
0
 
LVL 3

Author Comment

by:aravindtj
ID: 11931323

Hi,
 I got the solution for my recent question.
The code is as follows:

VOID LogEvent(NTSTATUS code, PDEVICE_OBJECT fdo)
{
      PWSTR myname = L"EventLog";

      ULONG packetlen = (wcslen(myname) + 1) * sizeof(WCHAR) + sizeof(IO_ERROR_LOG_PACKET) + 4;
      if (packetlen > ERROR_LOG_MAXIMUM_SIZE)
            return;                              // packet will be too big

      PIO_ERROR_LOG_PACKET p = (PIO_ERROR_LOG_PACKET) IoAllocateErrorLogEntry(fdo, (UCHAR) packetlen);
      if (!p)
            return;

      memset(p, 0, sizeof(IO_ERROR_LOG_PACKET));
      p->MajorFunctionCode = IRP_MJ_PNP;
      p->ErrorCode = code;
      p->DumpDataSize = 4;
      p->DumpData[0] = 0x2A2A2A2A;

      p->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + p->DumpDataSize - sizeof(ULONG);
      p->NumberOfStrings = 1;
      wcscpy((PWSTR) ((PUCHAR) p + p->StringOffset), myname);

      IoWriteErrorLogEntry(p);
}

Thanks for ideas.
0
 
LVL 1

Accepted Solution

by:
GhostMod earned 0 total points
ID: 11978750
PAQd, 500 points refunded.

GhostMod
Community Support Moderator
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I'll describe -- and show pictures of -- some of the significant additions that have been made available to programmers in the MFC Feature Pack for Visual C++ 2008.  These same feature are in the MFC libraries that come with Visual …
Introduction: Ownerdraw of the grid button.  A singleton class implentation and usage. Continuing from the fifth article about sudoku.   Open the project in visual studio. Go to the class view – CGridButton should be visible as a class.  R…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question