File System Filter Driver Tutorial

Introduction

This tutorial will show you how to develop a simple file system filter driver. The demo driver will print the names of opening files to the debug output.

The article requires basic Windows driver development and C/C++ knowledge. However, it may also be interesting to people without Windows driver development experience.

What is a file system filter driver?

A file system filter driver is called on every file system I/O operation (create, read, write, rename, and etc.), and thus it can modify the file system behavior. File system filter drivers are almost similar to legacy drivers, but they require some special steps to do. Such drivers are used by anti-viruses, security, backup, and snapshot software.

Creating a simple File System Filter Driver

Before starting

To build a driver, you need WDK or the IFS Kit. You can get them from Microsoft’s website. Also, you have to set an environment variable %WINDDK% to the path where you have installed the WDK/IFS Kit.

Be careful: Even a small error in the driver may cause a BSOD or system instability.

Read more: Codeproject

Posted via email from .NET Info