Hook W2000 File System

Hook W2000 File System

Post by Ruggero Ba » Fri, 21 Nov 2003 20:59:38


I need to Hook File System under Windows 2000/XP.

Under Windows98 I used this API:
- IFSMgr_InstallFileSystemApi Hook
- and the Handler FileSystemApiHookFunction

Ruggero Bandera

Hook W2000 File System

Post by Don Bur » Sat, 22 Nov 2003 00:10:07

You are going to need to do a file system filter driver, this is one of the
most complex kernel programming tasks in Windows. The proper place to ask
questions is the NTFSD list off of
http://www.yqcomputer.com/ (i.e. a
year or more).

There is only one book on file systems and it is old, "Windows NT File
System Internals : A Developer's Guide" by Rajeev Nagar (amazon has them
used for several hundred dollars). You will need to get the Windows IFS kit
http://www.yqcomputer.com/ , this costs $995 from
Microsoft and requires an NDA with them. Seriously consider the OSR class
"Developing File Systems for Windows", finally if you can afford it look at
the OSR File System Filter Kit (this is roughly $45000 the last I looked).

Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply