I have a minifilter driver based on the example Minivers See https://github.com/guidoreina/minivers ,
I am getting error codes on some files on the FltCreateFile which is to read the input file.
The error codes that i am receiving are
-1073741757 0xC0000034
STATUS_OBJECT_NAME_NOT_FOUND
Followed by another attempt
-1073741757 0xC0000043
STATUS_SHARING_VIOLATION
I am unsure where to go or change in order to troubleshoot the issue. I have looked at the MSDN page for FltCreateFile
Unfortunately the return values documented do not match the errors i am receiving.
Running on Windows 10 1803
I have tried modifying the Share access flags but still end up with the same errors.
I have done some more testing/investigation and decided to monitor a single directory in my case C:\temp within the minifilter. I believe my problem lies in the PreOperationCallback, as to when it calls the copy file. Below is my PreOperationCallback
FLT_PREOP_CALLBACK_STATUS PreOperationCallback(_Inout_
PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID* CompletionContext)
{
//PFILE_RENAME_INFORMATION renameInfo;
/* IRP-based I/O operation? */
if (FLT_IS_IRP_OPERATION(Data)) {
/* Open file? */
if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
/* Open file for writing/appending? */
if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
(FILE_WRITE_DATA | FILE_APPEND_DATA)) {
return process_irp(Data, FltObjects, CompletionContext, DEFERRED_IO, FALSE);
}
} else if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION) {
switch (Data->Iopb->Parameters.SetFileInformation.FileInformationClass) {
case FileDispositionInformation:
if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
}
break;
case FileEndOfFileInformation:
case FileRenameInformation:
// //https://stackoverflow.com/questions/40564824/how-to-cancel-a-rename-operation-in-minifilter-driver
//renameInfo = Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
//DbgPrint("Rename info length- '%u'", renameInfo->FileNameLength);
//memcpy(buf, renameInfo->FileName, renameInfo->FileNameLength);
//DbgPrint("Rename info - '%wZ'", renameInfo->FileName);
return process_irp(Data, FltObjects, CompletionContext, FALSE, TRUE);
}
}
}
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}
I get the errors listed above when i right click in the temp directory and create new rich text document or if i copy a file to the directory. A new file is created in the c:\temp and i receive the errors in the debugger. B.N - I have tried different files with different casing to confirm that i had no issues with filename casing.
Now if i delete the file i get the correct results, which is being done via
case FileDispositionInformation:
if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
}
break;
The process_irp - checks the file and generates a new location on where to move it to, it then calls the copy_file if all the criteria has been met.
BOOLEAN copy_file(PFLT_FILTER filter,
PFLT_INSTANCE instance,
UNICODE_STRING* dest,
UNICODE_STRING* src)
{
HANDLE hInput, hOutput;
PFILE_OBJECT out;
OBJECT_ATTRIBUTES attr;
IO_STATUS_BLOCK io_status_block;
PVOID buf;
ULONGLONG filesize;
NTSTATUS status;
InitializeObjectAttributes(&attr,
src,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
status = FltCreateFile(filter, /* Filter */
instance, /* Instance */
&hInput, /* FileHandle */
GENERIC_READ, /* DesiredAccess */
&attr, /* ObjectAttributes */
&io_status_block, /* IoStatusBlock */
NULL, /* AllocationSize */
FILE_ATTRIBUTE_NORMAL, /* FileAttributes */
FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE, /* ShareAccess */
FILE_OPEN, /* CreateDisposition */
FILE_SYNCHRONOUS_IO_NONALERT, /* CreateOptions */
NULL, /* EaBuffer */
0, /* EaLength */
IO_FORCE_ACCESS_CHECK); /* Flags */
if (!NT_SUCCESS(status)) {
DbgPrint("Could not create the file '%wZ' with STATUS '%d.\n' ",
dest,
status);
return FALSE;
}
}
Apologies this is first time writing in C and creating a driver, i have tried reading up on IRP as i think the issue lies here. My thoughts are that the file may not exist at the time of execution, hence i get the errors - I could be completely wrong.
Any help would be greatly appreciated.
User contributions licensed under CC BY-SA 3.0