Search code examples
filesystemsdriverpass-throughminifilter

Minifilter prevent new file created with warning dialog

I has written a minifilter in kernel mode. I want to prevent creating a new file on USB. But when I used:

[CODE]
    FltCancelFileOpen( FltObjects->Instance, FltObjects->FileObject );
    Data->IoStatus.Status = STATUS_ACCESS_DENIED; 
    Data->IoStatus.Information = 0;
    return FLT_PREOP_COMPLETE;
[CODE]

=> I could prevent creating a new file. But It always show warning dialog. What should i do to NOT show this dialog?

UPDATED: 2014/12/22
I am writing a fs minifilter driver for an sittuation. When User drag & drop a file or folder to USB (example H:)

  1. The driver will get file's information;
    ==> Done

  2. The driver will delete this file or folder (No file/ folder will be created on USB)
    - I just want to catch event to start app (3)
    - The files will be deleted before created on USB.
    **==> Done

  3. Do something.

=> Please give me an advice for this sittuation? Thanks a lot!

Solution

  • Now I could solve my issue by redirect open another file

    1. First, define new unicode string newfile = "abcdef.txt";

    2. Using FltGetFileNameInformation to get file name information

    3. Using FltParseFileNameInformation to pares it.

    4. Get file name which format : \Device\HarddiskVolume1[path_to_file]filename[.ext]

    5. Then, split it to part: \Device\HarddiskVolume1[path_to_file] and filename[.ext]

    6. Append newfile to first part: \Device\HarddiskVolume1[path_to_file]abcdef.txt

    7. Now I will open new file instead of old file as following:

      // Get old file name

      PUNICODE_STRING pFileName = &Data->Iopb->TargetFileObject->FileName;

      // Free release buffer

      ExFreePool(pFileName->Buffer);

      // Re-allocate buffer pFileName->Length = 0; pFileName->MaximumLength = redirectTargetFile.MaximumLength; pFileName->Buffer = (PWSTR) ExAllocatePool(NonPagedPool, pFileName->MaximumLength);

      // Assign new file name for it RtlCopyUnicodeString(pFileName, &unicode_string_new_file_name); // Tell the kernel to reparse this file open so it uses the new file path

      Data->IoStatus.Information = IO_REPARSE; Data->IoStatus.Status = STATUS_REPARSE; Data->Iopb->TargetFileObject->RelatedFileObject = NULL;

      FltSetCallbackDataDirty(Data); return FLT_PREOP_SUCCESS_WITH_CALLBACK;


    Reference http://www.codingnotebook.com/2013/05/redirect-file-open-using-windows.html