Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 712032">Interesting test.I would&#039;ve thought they&#039;d be protecting the files in the chosen directories from kernel-mode via a file system mini-filter device driver (and maybe they do), but what concerns me is how the last sample managed to evade the protection mechanism and affect the files, should that indeed be how the protection mechanism is enforced. Potentially an issue with their filtering, because the IRP_MJ_CREATE is still going to have to pass through the registered callback routines before the handle access to the file is granted to the caller, and IRP_MJ_WRITE is still going to pass through the registered callback routines before the write operation is successfully completed. Maybe they only block/enforce a notification for processes they deem &quot;suspicious&quot;, and default-allow for processes they don&#039;t believe are up to mischief. Hmm.Thanks for testing it out, nice review. [USER=7463]@cruelsister[/USER] <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Deleted member 65228, post: 712032"] Interesting test. I would've thought they'd be protecting the files in the chosen directories from kernel-mode via a file system mini-filter device driver (and maybe they do), but what concerns me is how the last sample managed to evade the protection mechanism and affect the files, should that indeed be how the protection mechanism is enforced. Potentially an issue with their filtering, because the IRP_MJ_CREATE is still going to have to pass through the registered callback routines before the handle access to the file is granted to the caller, and IRP_MJ_WRITE is still going to pass through the registered callback routines before the write operation is successfully completed. Maybe they only block/enforce a notification for processes they deem "suspicious", and default-allow for processes they don't believe are up to mischief. Hmm. Thanks for testing it out, nice review. [USER=7463]@cruelsister[/USER] :) [/QUOTE]

Verification