Re[2]: Re[2]: Reading a file only by using IofCallDriver

NTFSD
1

You can’t capture these IO requests in a fs filter driver since these
requests are ‘below’ the file system. To intercept these requests you
need to implement either a volume or disk class filter driver.

You can use the IoGetCurrentIrpStackLocation() to extract the current
request information. There is a stack location allocated for each
layered driver when the Irp is allocated based on the StackSize field in
the device object.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@gmail.com
To: “Windows File Systems Devs Interest List”
Sent: 10/13/2016 8:52:47 AM
Subject: RE:[ntfsd] Re[2]: Reading a file only by using IofCallDriver

>Thank you for the help everyone.
>I’ve found the data that is used to find the file in the
>Overlay->CurrentStackLocation->Parameters field which contains a single
>pointer. It points to a structure that contains among other things the
>size of data to read. The rest I still need to figure out.
>
>Is there a way to catch file reads like that with FS filters or
>minifilters or does this method of reading files bypass these
>mechanisms?
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

2

Thank you again for the response.

I’ve been reading about setting up device filters but the information online is not really beginner friendly. I’ve attached a volume filter to the mentioned device by using the following:

  1. IoGetDeviceObjectPointer (for target device)
  2. IoGetDeviceAttachmentBaseRef
  3. IoCreateDevice (create the filter device)
  4. IoAttachDeviceToDeviceStackSafe

So now I can filter most IRPs - except the ones being sent when the driver (the one I’ve been researching) first calls IoGetBaseFileSystemDeviceObject. It looks like this function allows that driver to bypass my filter driver again.

The question is, is there any way to catch these IRPs? Can a lower-level filter help in this situation? If the answer to that question is yes, then my next question is how do I set a lower-level filter?