In our tutorial, we"ve provided you with simple steps for creating a file system filter driver. The makefile is standard: SC.EXE overview Return DeviceObject-> Sources and makefile PFSFILTER_DEVICE_EXTENSION pDevExt = (PFSFILTER_DEVICE_EXTENSION)īOOLEAN FsFilterIsMyDeviceObject(_in PDEVICE_OBJECT DeviceObject) Void FsFilterDetachFromDevice(_in PDEVICE_OBJECT DeviceObject) Return (fastIoDispatch-> Fast I/O detach device Notification.c AttachDetach.c Attaching Detaching If (VALID_FAST_IO_DISPATCH_HANDLER(fastIoDispatch, FastIoQueryBasicInfo)) PFAST_IO_DISPATCH fastIoDispatch = nextDeviceObject->DriverObject PDEVICE_OBJECT nextDeviceObject = ((PFSFILTER_DEVICE_EXTENSION)ĭeviceObject->DeviceExtension)->AttachedToDeviceObject Pass through logic for this type of Fast I/O ((_FastIoDispatchPtr)->_FieldName != NULL)) Fast I/O pass-throughīOOLEAN FsFilterFastIoQueryBasicInfo(_in PFILE_OBJECT FileObject, (FIELD_OFFSET(FAST_IO_DISPATCH, _FieldName) + sizeof(void *))) & \ (((_FastIoDispatchPtr)->SizeOfFastIoDispatch) >= \ #define VALID_FAST_IO_DISPATCH_HANDLER(_FastIoDispatchPtr, _FieldName) \ Macro to test if FAST_IO_DISPATCH handling routine is valid PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject ĭbgPrint("%wZ\n", &pFileObject-> FastIo.c NTSTATUS FsFilterDispatchCreate(_in PDEVICE_OBJECT DeviceObject, Return IoCallDriver(pDevExt-> Dispatch create
MISSING INTERNET AFTER UNINSTALLING AVAST ANTIVIRUS DRIVER
Set driver unload routine (debug purpose only). NTSTATUS DriverEntry(_inout PDRIVER_OBJECT DriverObject,ĭriverObject-> Setting driver unload routine DriverEntry - Entry point of the driver MajorFunction = FsFilterDispatchPassThrough