what's up guys I'm Langester. In the next couple of videos we will talk
about file system filter. In general there are two types of file system
filter, one is called legacy file system filter, another is called minifilter
as for the legacy file system filter, a large amount of works are
required when we are attaching our driver to the file system and process
IRP requests, whereas for minifilter those works are pretty much done by
what we called filter manager for us. in this video we will talk about minifilter
the first thing we need to know is that the mini future required the inf
file to load itself
so we don't use osrloader to load our driver just like we did
before and also we need to register our driver to the filter manager and start our driver before we filter the target IRP requests that are interested unlike the dispatch function and completion routines in the previous tutorials there are two types of operation callbacks in minifilter the one is pre operation callbacks and post operation callbacks, the pre-operation callbacks is like dispatch function we write in other projects and the post operation callbacks is like the completion routines we set in The Dispatch functions in previous project the way it works is like we registered the pre or post operation callbacks individually to the filter manager and when the IRP passed to the filter manager it will pass this IRP to the pre or post operation callbacks according to the callbacks we registered to the filter manager and in the meantime we don't have to process IRP structures in these two operation callbacks. so basically there aren't too much works involved in processing data in this two operation callbacks. okay let's go back to the project and write this minifilter in fact we can create a minifilter project in Visual Studio. we click file and create a new project instead of legacy options we'll choose device options and in the right panel we can see filter driver file system minifilter and we choose this project and click OK as you can see here under the source folder the visual studio has already generated source code for us this is a complete code in this source file. since this is a demo project I will delete all the code here and write our mini filter from scratch. as you can see we only leave the header here. as always the first thing we need to do is write the driver entry function. one of the differences between the minifilter and regular driver we write before is that we don't need to register our unload function in this driver object. how do we register our unload function to the windows so that we can unload our driver? I will talk about that in just seconds and what we are going to do next is register ourselves to the filter manager. we use a function called register filter, the first parameter we passed in is driver object, the next parameter is a core structure in our registration process, the last parameter is a filter handle return to us which we will use in the following functions. we have to check the status of this function. if this function failed basically we can't do anything about it so we just return the unsuccessful status not to load our driver if this function succeeded next we can start our filtering. Starting filtering function only takes one parameter which is the filter handle we received from the register filter function. we also need to check the status of the structure if this function failed don't forget to unregister our filter. the only parameters is a filter handle. if all things are set and done correctly our minifilter will start at this point so let's defines our filter handle and the registration structure here the structure is called filter registration structure the first member is the size of this structure the second one is our version, we simply set this to filter registration version the next member is flag. we simply set this member to zero. the next is a context registration member. we don't use it in this project. we simply set it to null. the next is the most important member. this is where we register our calllbacks and next is where we register our unload function. For the next eight numbers we don't use them in this project so we simply set them to NULL and if you want to know those numbers, you can check them out in MSDN website okay let's define this structure. you can see here if he's actually a structure array and the last member is always IRP major operation end so that the windows will know that this is actually the end of the structure array. in this project we want to filter IRP major create requests so we can do like this, IRP major create. next is flag, we can simply set to zero and the next is the pre operation callbacks and next is post operation callback function. and also we want to filter our IRP major write operations so we can continue the registration process. if we don't want to implement any of this operation callbacks we simply set it to NULL since we don't want to implement the post write callbacks we set it to NULLhere okay the registration process is finished Let's write our unload function as well as operation callbacks the prototype of this unload function is a little bit different from our previous unload function. In unload function we actually do one thing which is unregister our filter and we return successful status