okay let's write pre operation callbacks. it has three
parameters. all of information we want to retrieve is included in this data
structure and the next is a filter related objects. we don't use them in
this project so we will talk about it in other tutorials. the last one is a
completion context. for this project I only print file name in this
operation callbacks as an example so the first thing we need to do is to retrieve the file name
this function will retrieve the file name from this data structure
for the name options, we simply set this to filter file name normalized
and file name query default and the last parameter is file name
information return to us
let's define this structure
if this function succeeded we can parse this name information to retrieve the
real file name. the only parameter we pass in is a file name information we
retrieved from the last function. one thing I need to mention is that don't forget to
release the file name information. okay if the parse file name information
function succeeded we can actually get a real file name
we can copy the file name into our own buffer and I'll print it out
the size of this name is in the name member -> maximumlength. the name is
actually included in this buffer member
okay finally return the status. since we found our post create operation
callbacks so we return with callback to filter manager indicating that
we have post operation callbacks to be called and then if we return
success no callback, our post create operation callbacks will never be called by
the filter manager. okay let's write post create operation callback, this post
operation callback has four parameters. the first three parameters are the same
as the parameters in the pre operation callbacks so I simply copy and paste
the last one is the operation flags. we don't do anything except we print some
message indicating that our post operation callbacks is really called by
the filter manager and we return status called post op finished processing. the last
operation callback is a pre write operation callback
The pre-operation callback has the same prototype so we copy and paste all
this code here and we change the name
and here we can do a test where we compare file name passed in from the
filter manager to the target file name If this name is matched to the target
file name we simply complete this IRP requests which means the IRP major write
request will never get to the file system and the write operation will
never be completed. so in this project the target file name is called openme.txt
in case we have uppercase or lowercase character, we always change this file
name to the uppercase and first we print message telling us that we
actually find this file request and next what we need to do is pretty much
the same as we did in our other tutorials. the difference is that we only
change the member in the data structure not IRP itself. so first we need
to change the status of the data structure to some error status so in this
project we choose status invalid parameters you can choose other error
parameters as you want
since we blocked this IRP write operations so the real transferring size
is actually zero and don't forget to release this file information and
finally we return the pre op complete
when the filter manager sees our pre-op complete status it will never
pass this IRP down to the driver below us. so it is equivalent to the IOcomplete
functions we called in our dispatch functions in previous projects
okay let's do some changes to the solution and as I have said before for
the minifilter we need a inf file to load ourselves so we have to configure
this Inf first before we load our driver. Under the driver files folder
there is a inf file so we double-click it
and In this inf file you can see the class and the class ID. we
simply copy this and the most important members is called altitude we must
change this to the proper number please bear in mind that we can't assign the
random number as we want. Windows has defined a range of numbers for us
where we can pick up some random number and you should check the range of this
number before you assigned this number. you can check it out in Microsoft
website. so here in this project we choose the number here
I think this is pretty much it
and let's build our project. there is some errors. alright build succeeded
let's test this minifilter in the VirtualBox and there is and error here because
we only have pre write operations, we don't return the with callback but no
callback. we save it and build this project and we drag and drop the
system file and the inf file. first we open this inf file as you can see
here the service name is called fsfilter1. right click it and install. ok
let's open the command prompt with admin privilege and we type net start fsfilter1
This is the service name we just saw in the inf file we open the debugview and we
press ENTER. as you can see here our minifilter has started successfully and
in debugview it prints our message constantly so let's test our project we
have created openme.txt file so we open it and we write some random characters
and we closed it out save. as you can see here the
notepad is popping up error message saying that parameter is incorrect and
we don't save this time
since there are too many prints out there so we cannot easily find these
prints so we found this. so we successfully blocke openme.txt
file from writing status. Let's stop minifilter alright
minifilter stopped successfully you can see the driver unload message is
printed out so let's try it again we write one two three four five six and
save you can see this time we successfully write the data into the openme file
basically it means our minifilter succeed and as always I hope you
enjoyed this video and in the next video we will talk about the built-in
communication system by which we can communicate our application with
minifilter. See you in the next video.