Skip to content

Latest commit

 

History

History
32 lines (26 loc) · 1.58 KB

README.md

File metadata and controls

32 lines (26 loc) · 1.58 KB

driverFilter

A filter driver for Windows 7/8/8.1/10 that allows you to restrict the access rights of processes to objects in the file system. The File system Mini-filter driver template was used as a basis. To start, you need a WDK for your version of Windows.

Functions

This driver can:

  • read information from the configuration file conf.txt;
  • block the process of reading, depending on the rights;
  • block the process of writing, depending on the rights;
  • Simultaneously block the process of reading and writing, depending on the rights.

Configurating

The configuration file conf.txt should be located in C:\Windows folder. It has the following structure:

<path_to_file_1> <path_to_process_1> xy

<path_to_file_n> <path_to_process_n> xy

Two numbers - xy, which can be either 0 (enable) or 1 (disable); the number x is responsible for writing, and y for reading.

Algorithm

Access is blocked according to the following algorithm:

  1. getting the name of the file that the process is accessing;
  2. search for a matching file name in the access_array list;
  3. if there is a match, the process name is obtained;
  4. comparison of the name with the proc field of the structure;
  5. if there is a match, we check the number field (this field contains two numbers - xy, which can take values ​​either 0 (permission) or 1 (prohibition); number x is responsible for writing, and y for reading);
  6. depending on the value of number, enable / disable is performed.

Debug and start

The driver can be debugged using the DbgView utility. Driver registration and start can be done through OSR Driver Loader.