Re: Hooking IRPs

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

even if you bypass filemon, i can set a bp on your driver's read/write
dispatch routines and see the data.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Peter" <Peter@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5E659985-C877-4988-9228-8457DA360F42@xxxxxxxxxxxxxxxx
Yes it is security concern. Tools like filemon can be used for example to
catch reading/writting product key from/to file.

Peter

"Don Burn" wrote:

Filemon is just a file system filter driver, trying to hide from such a
driver would break the system completely. I assume this is a security
concern, but the only way to run Filemon is with priviledges to load
drivers, once you are in the kernel there is no security from other
kernel
components.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply



"Peter" <Peter@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:57AC307D-E5F8-4CDB-B4D6-55FF93415394@xxxxxxxxxxxxxxxx
Tools like filemon hooks IRPs sent to file system driver. I dont know
details, but it seems that does not exist way to hide Read/Write
operations
from such tools ?

Peter





.

Relevant Pages

  • Re: USB high speed
    ... If you measured the performance by copy/paste files through UI, then there is a limitation on the payload size enforced by filesys (when filesys issues read/write operations down to storage driver level). ... >> Windows Devices Core BSPs ...
    (microsoft.public.windowsce.embedded)
  • sleeping in request function
    ... I have a USB card reader. ... It is capable of read/write CF, ... While looking into driver, ... send the line "unsubscribe linux-kernel" in ...
    (Linux-Kernel)
  • KMDF nonpnp port driver
    ... I'm trying to write a KMDF driver to read/write to a couple of I/O ... The ports are non plug and play (don't show up as resources in device ...
    (microsoft.public.development.device.drivers)
  • Exclusive control
    ... The driver supports read/write system call. ... A tasklet and the read/write routines access the same resources. ...
    (comp.os.linux.development.system)