I’m new to creating kernel mode drivers, or drivers in general for that matter.
I specialize in c#, but I don’t know lower level languages like c++ or assembly.
I know that I will probably have to learn a lower level language first, but assuming
I’ve already learned a language that works well, what would be the general steps
that I would have to take to create a Windows Filesystem Filter Driver? I would also
like to know what language I should use, and I would love it if someone could
point me towards step by step video tutorials that teach me how to program
such a driver, because I don’t just want to see the small picture. I also want to see
the bigger picture in terms of how I should go about doing what I want to do.
This brings me to my end goal. I want to be able to create a kernel mode driver
that you can interact with through c# in a way that is fast and reliable. My plan
is to create a system that allows you to set rules for individual programs in terms of
what parts of the filesystem they can read and write. This way anyone who uses my
program, can easily intercept IO requests, and I won’t have to worry about it
in the future. Instead of using events in a high level program, I think the ability to
setup rules for the system would allow it to process data a lot faster. If anyone could
help, it would be greatly appreciated, but I really don’t want to have to create
a driver, so if anyone knows about something similiar, I would much prefer
that instead as long as it allows me to intercept IO requests in a fast and reliable way.
Thanks!
In short
Language: C and C++( a confined subset of C++ w/o calling constructors for global class objects, no C++ exceptions, no C++ RTTI ), the only really new fields for you would be pointers and lack of GC(Garbage Collection).
File system filters examples: https://github.com/Microsoft/Windows-driver-samples/tree/master/filesys/miniFilter
First thing first why u want to create a file system filter driver??
If you know why??
then this book is a BiBle for developing windows file system filters some of the content are old however still a great book for understanding windows NT file system architecture and filters.
https://store.osr.com/product/osrs-classic-reprints-windows-nt-file-system-internals/.
The above link is a good start point but i suggest first learn basics if u have no idea about NT architecture.
./Nt
Thanks! The reason I want to create a file system filter driver is so that
later on I can use a library that I’ll make as well that will allow the
developer to interact with the file system with even more options than
what’s given to them by default. This means the developer could do more
without creating a driver. Of course, in order for the library to do it’s
job, it will interact with the filesystem filter driver. The big feature I
want to add to this library is the ability to create rules for programs
that will allow or deny their read or write access to certain parts of the
computer. I will then use this library for a virtualization program that
will allow you to run potentially malicious programs on a web server or on
your own computer without having to create a new VM and then install an
OS. Instead, you could use a very powerful container which ensures that
the program won’t harm your computer. Plus, the container would be very
light weight.