Cannot read file with Windows minifilter driver

1

I have a minifilter driver based on the example Minivers See https://github.com/guidoreina/minivers ,

I am getting error codes on some files on the FltCreateFile which is to read the input file.

The error codes that i am receiving are

-1073741757 0xC0000034

STATUS_OBJECT_NAME_NOT_FOUND

Followed by another attempt

-1073741757 0xC0000043

STATUS_SHARING_VIOLATION

I am unsure where to go or change in order to troubleshoot the issue. I have looked at the MSDN page for FltCreateFile

See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nf-fltkernel-fltcreatefile

Unfortunately the return values documented do not match the errors i am receiving.

Running on Windows 10 1803

I have tried modifying the Share access flags but still end up with the same errors.

I have done some more testing/investigation and decided to monitor a single directory in my case C:\temp within the minifilter. I believe my problem lies in the PreOperationCallback, as to when it calls the copy file. Below is my PreOperationCallback

FLT_PREOP_CALLBACK_STATUS PreOperationCallback(_Inout_ 
PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, 
_Flt_CompletionContext_Outptr_ PVOID* CompletionContext)
{
  //PFILE_RENAME_INFORMATION renameInfo;

  /* IRP-based I/O operation? */
  if (FLT_IS_IRP_OPERATION(Data)) {
  /* Open file? */
    if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
    /* Open file for writing/appending? */
     if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
      (FILE_WRITE_DATA | FILE_APPEND_DATA)) {
    return process_irp(Data, FltObjects, CompletionContext, DEFERRED_IO, FALSE);
  }
} else if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION) {

  switch (Data->Iopb->Parameters.SetFileInformation.FileInformationClass) {

    case FileDispositionInformation:
          if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
            return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
          }

      break;
    case FileEndOfFileInformation:
    case FileRenameInformation:

     //   //https://stackoverflow.com/questions/40564824/how-to-cancel-a-rename-operation-in-minifilter-driver
        //renameInfo = Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
        //DbgPrint("Rename info length- '%u'", renameInfo->FileNameLength);
        //memcpy(buf, renameInfo->FileName, renameInfo->FileNameLength);
        //DbgPrint("Rename info - '%wZ'", renameInfo->FileName);


      return process_irp(Data, FltObjects, CompletionContext, FALSE, TRUE);
      }
    }
  }

return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

I get the errors listed above when i right click in the temp directory and create new rich text document or if i copy a file to the directory. A new file is created in the c:\temp and i receive the errors in the debugger. B.N - I have tried different files with different casing to confirm that i had no issues with filename casing.

Now if i delete the file i get the correct results, which is being done via

case FileDispositionInformation:
  if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
            return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
  }

 break;

The process_irp - checks the file and generates a new location on where to move it to, it then calls the copy_file if all the criteria has been met.

BOOLEAN copy_file(PFLT_FILTER filter,
              PFLT_INSTANCE instance,
              UNICODE_STRING* dest,
              UNICODE_STRING* src)
{
    HANDLE hInput, hOutput;
    PFILE_OBJECT out;
    OBJECT_ATTRIBUTES attr;
    IO_STATUS_BLOCK io_status_block;
    PVOID buf;
    ULONGLONG filesize;
    NTSTATUS status;

    InitializeObjectAttributes(&attr,
                             src,
                             OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                             NULL,
                             NULL);



    status = FltCreateFile(filter,      /* Filter            */
          instance,                     /* Instance          */
          &hInput,                      /* FileHandle        */
          GENERIC_READ,                 /* DesiredAccess     */
          &attr,                        /* ObjectAttributes  */
          &io_status_block,             /* IoStatusBlock     */
          NULL,                         /* AllocationSize    */
          FILE_ATTRIBUTE_NORMAL,        /* FileAttributes    */
          FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE,   /* ShareAccess       */
          FILE_OPEN,                    /* CreateDisposition */
          FILE_SYNCHRONOUS_IO_NONALERT, /* CreateOptions     */
          NULL,                         /* EaBuffer          */
          0,                            /* EaLength          */
          IO_FORCE_ACCESS_CHECK);       /* Flags             */






    if (!NT_SUCCESS(status)) {

        DbgPrint("Could not create the file '%wZ' with STATUS '%d.\n' ",
          dest, 
          status);

      return FALSE;
    }
}

Apologies this is first time writing in C and creating a driver, i have tried reading up on IRP as i think the issue lies here. My thoughts are that the file may not exist at the time of execution, hence i get the errors - I could be completely wrong.

Any help would be greatly appreciated.

c
windows
driver
asked on Stack Overflow Aug 14, 2019 by user1403598 • edited Aug 17, 2019 by user1403598

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0