Writing FileSystem Filter Driver. How to Start?

Posted on 2004-08-23
Medium Priority
Last Modified: 2013-11-20
Hi Experts,
 I want to write a filter driver to intercept all the file IO requests.
 I also need to identify the invoking application, type of request, the target file requested.
 Using that, I want to block some applications to access some sensitive files.
 Can you tell me, How to/ From where to start? I am using VC++ 6 & WIndows 2000.
 I am also having DDK for Windows 2000. I am stuck at starting to write a simple device driver.
 Is there any way to develope such type of drivers portable to all Win32 Platforms?
 If providing any sample code along with documentation, it will help me more.

 with regards,
Question by:aravindtj
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 3

Author Comment

ID: 11893928
Here I get some basic info.


But, I dont want to use DDK.

How to do?

Expert Comment

ID: 11911202
To build a file system filter DRIVER you have to use the DDK.

A filter driver written for Windows 2000 will work on XP, but will not work on 95,98&ME.

Although you request sounds like a fairly trivial matter, in fact it is quite a complicated bit of code.

Author Comment

ID: 11912080
Hi Rhodgson,
  Thanks for your reply.
  I know that my requirement is complicated.
  But, I am newbie to driver development.
  So, I want to know about the Basic concepts in writing and testing Device drivers.
  Like, the driver I supposed to develope will display all the file system call like open, read, write of files.
  I know that the drivers are not compatible with Win NT and Win 9x systems. But, I refered KernalDriver tools website that they are providing drives compatible with all Windows platforms.

  If you have any simple, sample code in c++ to write a elementary device driver for win2k,
  it will help me a lot.

  I refered some books like, DDK documentation, WindowsNT File System Internals, Programming the Microsoft Windows Driver Model by Walt Oney, The Windows 2000 Device Driver Book, A Guide for Programmers, Second Edition by Art Baker,Jerry Lozano etc.
  But nowhere, I found how to start and from where to start?

Thanks in advance.
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Expert Comment

ID: 11912669
The KernalDriver tools that provide functionality for both NT and 95 versions include both a SYS driver and a VXD driver which have to be developed seperately.

Device Drivers are actually harder to write in C++ without additional tools, because C++ relies on the C runtime libraries which are not available in device drivers.  So you either have to build the C++ support functions, buy a library that does this, or stick with C for writing device drivers.

Template device drivers are available in the DDK samples folder, and Microsoft used to also provide an "IFS kit" to help you work with the filing system.  I havn't built any device drivers in quite some time so I am not completely up to date on what source Microsoft provide and where you would find it at the moment.

http://www.sysinternals.com provide "filemon" which probably does everything you are interested in and quite a lot more.  Again they used to provide source for this utility (I certainly have the source to v4.28), so perhaps that is available somewhere on the internet.

I would post example code in my reply, however device driver code is rather large, with the Microsoft sample filter driver shell stetching to over 3,000 lines of code (the file being called sfilter.c).


Author Comment

ID: 11914681
Hi Rhodgson,
  Thanks for your reply.
 I can't get the source code for "filemon" the www.sysinternals.com site. Can you send me the source code? It will be helpful, if send the sample code to me.
 I have one more doubt. How to test the driver after installing. ie, I installed a driver for monitoring file system calls. I a file is openned for writing, some notification like a message box must pop.
 How to do this?
 I am not having IFS now.And I have DDK.

Thanks in advance.


Expert Comment

ID: 11914842
Unfortunately the license clearly states I cannot distribute the source files, so if you can't find it on the sysinternals website then I guess it is no longer publicly available.  The IFS kit comes with a similiarly restrictive license.

To open a message box from a driver, you would normally run another process in user space, or the system account which checks the driver and then produces the message box when the driver returns a signal.

Like I said at in my first response to do what you are asking is far from a trivial piece of work.

Author Comment

ID: 11920890

Thanks lot Mr Rhodgson.

I developed a driver. And How can send the driver debug messages [like using DbgPrint(..,..)] directly to system Event Log. So, I can view the driver events using the Eventviewer. I can write events in eventlog for my applications by ReportEvent method. But is not working in driver programming.
 How to do this?

Thanks in advance.


Author Comment

ID: 11921082

Hi Mr Rhodgson,

 In the book "Windows NT Event Logging" by  James D. Murray,   http://www.oreilly.com/catalog/winlog/chapter/ch02.html  I learn that I cann't access the Event Logging API for the Kernal mode programs like Drivers. It is foronly user applications.

 I also says that we can only access that service through the I/O Manager.

 How to do that?

Author Comment

ID: 11931323

 I got the solution for my recent question.
The code is as follows:

      PWSTR myname = L"EventLog";

      ULONG packetlen = (wcslen(myname) + 1) * sizeof(WCHAR) + sizeof(IO_ERROR_LOG_PACKET) + 4;
      if (packetlen > ERROR_LOG_MAXIMUM_SIZE)
            return;                              // packet will be too big

      PIO_ERROR_LOG_PACKET p = (PIO_ERROR_LOG_PACKET) IoAllocateErrorLogEntry(fdo, (UCHAR) packetlen);
      if (!p)

      memset(p, 0, sizeof(IO_ERROR_LOG_PACKET));
      p->MajorFunctionCode = IRP_MJ_PNP;
      p->ErrorCode = code;
      p->DumpDataSize = 4;
      p->DumpData[0] = 0x2A2A2A2A;

      p->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + p->DumpDataSize - sizeof(ULONG);
      p->NumberOfStrings = 1;
      wcscpy((PWSTR) ((PUCHAR) p + p->StringOffset), myname);


Thanks for ideas.

Accepted Solution

GhostMod earned 0 total points
ID: 11978750
PAQd, 500 points refunded.

Community Support Moderator

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction: Database storage, where is the exe actually on the disc? Playing a game selected randomly (how to generate random numbers).  Error trapping with try..catch to help the code run even if something goes wrong. Continuing from the seve…
Introduction: The undo support, implementing a stack. Continuing from the eigth article about sudoku.   We need a mechanism to keep track of the digits entered so as to implement an undo mechanism.  This should be a ‘Last In First Out’ collec…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question