what's up guys I'm Langester. In the next couple of videos we will talk
about file system filter. In general there are two types of file system
filter, one is called legacy file system filter, another is called minifilter
as for the legacy file system filter, a large amount of works are
required when we are attaching our driver to the file system and process
IRP requests, whereas for minifilter those works are pretty much done by
what we called filter manager for us. in this video we will talk about minifilter
the first thing we need to know is that the mini future required the inf
file to load itself
so we don't use osrloader to load our driver just like we did
before and also we need to register our driver to the filter manager and start
our driver before we filter the target IRP requests that are interested
unlike the dispatch function and completion routines in the previous
tutorials there are two types of operation callbacks in minifilter the one is
pre operation callbacks and post operation callbacks, the pre-operation
callbacks is like dispatch function we write in other projects and the post
operation callbacks is like the completion routines we set in The
Dispatch functions in previous project
the way it works is like we registered the pre or post operation callbacks
individually to the filter manager and when the IRP passed to the filter
manager it will pass this IRP to the pre or post operation callbacks according
to the callbacks we registered to the filter manager and
in the meantime we don't have to process IRP structures in these two operation
callbacks. so basically there aren't too much works involved in processing data
in this two operation callbacks. okay let's go back to the project and write
this minifilter
in fact we can create a minifilter project in Visual Studio. we click file
and create a new project instead of legacy options
we'll choose device options and in the right panel we can see filter driver
file system minifilter and we choose this project and click OK
as you can see here under the source folder the visual studio has already
generated source code for us
this is a complete code in this source file. since this is a demo
project I will delete all the code here and write our mini filter from
scratch. as you can see we only leave the header here. as always the first thing we
need to do is write the driver entry function. one of the differences between
the minifilter and regular driver we write before is that we don't need to
register our unload function in this driver object. how do we register our
unload function to the windows so that we can unload our driver? I will talk
about that in just seconds and what we are going to do next is register
ourselves to the filter manager. we use a function called
register filter, the first parameter we passed in is driver object, the next
parameter is a core structure in our registration process, the last parameter
is a filter handle return to us which we will use in the following
functions. we have to check the status of this function. if this function failed
basically we can't do anything about it so we just return the unsuccessful
status not to load our driver
if this function succeeded next we can start our filtering. Starting filtering
function only takes one parameter which is the filter handle we received from
the register filter function. we also need to check the status of the
structure if this function failed don't forget to unregister our filter. the only
parameters is a filter handle. if all things are set and done correctly our
minifilter will start at this point so let's defines our filter handle and the
registration structure here
the structure is called filter registration structure the first
member is the size of this structure
the second one is our version, we simply set this to filter registration version
the next member is flag. we simply set this member to zero. the next is a
context registration member. we don't use it in this project. we simply
set it to null. the next is the most important member. this is where we
register our calllbacks and next is where we register our unload function. For
the next eight numbers we don't use them in this project so we simply set them to
NULL and if you want to know those numbers, you can check
them out in MSDN website
okay let's define this structure. you can see here if he's
actually a structure array and the last member is always IRP major
operation end so that the windows will know that this is actually the end of
the structure array. in this project we want to filter IRP major create
requests so we can do like this, IRP major create. next is flag, we
can simply set to zero and the next is the pre operation callbacks
and next is post operation callback function. and also we want to filter
our IRP major write operations so we can continue the registration
process. if we don't want to implement any of this operation callbacks we simply
set it to NULL since we don't want to implement the post write
callbacks we set it to NULLhere okay the registration process is finished
Let's write our unload function as well as operation callbacks
the prototype of this unload function is a little bit different from our previous
unload function. In unload function we actually do one thing which is
unregister our filter and we return successful status