minifilter

I can't break when attaching to target machine in kernel debug mode

北城以北 提交于 2019-12-03 16:07:34
I am starting a prototype including a Windows minifilter. I have set up my environment: a target Virtual Machine (actually 3: a Windows 7, 8 and 8.1) a host development machine (which hosts Visual Studio 2013 and HyperV VMs) I finally managed to deploy the test minifilter to the target machine, but my problem is: I can not break the kernel in the target machine. When I make a build and start from Visual Studio Debugger, here is the result: ----------------------------------------------------------------------- ----------------------------------------------------------------------- Starting New

How to cancel a rename operation in minifilter driver

给你一囗甜甜゛ 提交于 2019-12-02 11:42:05
问题 I would like to cancel a rename operation in my minifilter. I've written the code that detects when a file is being rename, but I'm unclear on how to actually cancel the operation. Can anyone help me out with this? Here is my callback routine that detects for file rename. FLT_PREOP_CALLBACK_STATUS PreSetInformation( _Inout_ PFLT_CALLBACK_DATA Cbd, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext ) { if (Cbd->Iopb->Parameters.SetFileInformation

FileSystem MiniFilter Driver compiled with WDK 8.0 not showing DbgPrint output (DbgView/Win7 32 bit)

試著忘記壹切 提交于 2019-12-01 11:15:20
I wrote and compiled a minifilter driver using WDK 7.0 build utility for Windows 7 32 bit. Then i installed it on a Windows 7 (32 bit) machine running on VMWare using OSR's driver loader utility. When i ran DbgView, i could see the DbgPrint output accurately. Then i compiled that very same driver using WDK 8.0 integrated in Microsoft Visual Studio Pro 2012 for Windows 7 (32 bit). That created 3 files as a result, a sys, cat and inf file. I installed the Driver on a Windows 7(32 bit) machine running on VMWare, by right clicking the inf file and selecting 'install'. Then i started the service

FileSystem MiniFilter Driver compiled with WDK 8.0 not showing DbgPrint output (DbgView/Win7 32 bit)

末鹿安然 提交于 2019-12-01 09:24:11
问题 I wrote and compiled a minifilter driver using WDK 7.0 build utility for Windows 7 32 bit. Then i installed it on a Windows 7 (32 bit) machine running on VMWare using OSR's driver loader utility. When i ran DbgView, i could see the DbgPrint output accurately. Then i compiled that very same driver using WDK 8.0 integrated in Microsoft Visual Studio Pro 2012 for Windows 7 (32 bit). That created 3 files as a result, a sys, cat and inf file. I installed the Driver on a Windows 7(32 bit) machine