Intercepting File Changes

[Steve136]

Hello,

Great project! I was wondering whether or not the driver could be modified to intercept changes to files, such as renaming, deletion etc. and block these (from C#)?

For example, if I wanted to protect certain folders and lock a file from being deleted or stop it being renamed, based on a file list I have in C#.

I am more than happy to have a go at this myself, just need pointing in the right direction.

Thanks,

[0x4a616e]

From the top of my head, i think that'd require bigger changes. Right now, the driver collects file system events in a buffer, which is then pulled by the C# application. So right now, there is no way to get feedback from your app while processing individual interrupts in the driver.
That being said, it is possible for the driver to synchronously ask your application whether or not an file system operation should be performed, and cancel it in the latter case. When your C# app connects to the driver, the driver remembers the communication port in the SpyConnect method: MiniFSWatcherData.ClientPort = ClientPort;
So what i'd try to do is in the SpyPreOperationCallback send a message to this port and than wait for the response. Your C# app on the other hand would have to listen on SafePortHandle port; assigned in FilterConnector and send some appropriate response back to the driver. For the communication, you would have to create some simple binary protocol... I don't know right know if this is the best approach, but it's certainly where I'd start.

[Steve136]

That's great! Thank you. I will be certainly giving it a go.

Essentially I had an idea of creating a file vault and monitor to protect my PC from Cryptolocker variants. The idea was if I can detect which process changes a file extension (e.g. .docx) and it's process isn't Word or Explorer then something may be suspicious. Or go about checking the actual changed file to make sure it's valid document...

I started with the FileSystemWatcher in C# but among other things that doesn't give you the process which altered the file.

Thanks for the info! I'll see how far I can get with this.

[0x4a616e]

Sounds interesting, I'm curious how things will work out. This seems to be the method you'll need to call your app from the driver: https://msdn.microsoft.com/en-us/library/windows/hardware/ff544378(v=vs.85).aspx
An alternative approach would maybe be to mark interrupts as pending and collect them in the buffer in the driver. The user mode application can then fetch the events like it is now and report to the driver which event should be completed and which one shouldn't. However, take care that you don't completely block you're OS from working with the file system 😉