Initializes the necessary components of the filesystem filter. @param DriverObject - The object of the driver necessary for mini-filter initialization. @param RegistryPath - The registry path of the driver. @param UnloadRoutine - The function to call on the unload of the mini-filter. @param Detector - Detection instance used to analyze untrusted operations. @param InitializeStatus - Status of
| 21 | @param FilterHandle - The pointer to place the handle for the filter to. |
| 22 | */ |
| 23 | FSBlockingFilter::FSBlockingFilter ( |
| 24 | _In_ PDRIVER_OBJECT DriverObject, |
| 25 | _In_ PUNICODE_STRING RegistryPath, |
| 26 | _In_ PFLT_FILTER_UNLOAD_CALLBACK UnloadRoutine, |
| 27 | _In_ PDETECTION_LOGIC Detector, |
| 28 | _Out_ NTSTATUS* InitializeStatus, |
| 29 | _Out_ PFLT_FILTER* FilterHandle |
| 30 | ) |
| 31 | { |
| 32 | |
| 33 | FSBlockingFilter::FileStringFilters = new (PagedPool, STRING_FILE_FILTERS_TAG) StringFilters(FilesystemFilter, RegistryPath, L"FileFilterStore"); |
| 34 | if (FSBlockingFilter::FileStringFilters == NULL) |
| 35 | { |
| 36 | DBGPRINT("FSBlockingFilter!FSBlockingFilter: Failed to allocate memory for string filters."); |
| 37 | *InitializeStatus = STATUS_NO_MEMORY; |
| 38 | return; |
| 39 | } |
| 40 | // |
| 41 | // Restore existing filters. |
| 42 | // |
| 43 | FSBlockingFilter::FileStringFilters->RestoreFilters(); |
| 44 | |
| 45 | // |
| 46 | // This isn't a constant because the unload routine changes. |
| 47 | // |
| 48 | FSBlockingFilter::FilterRegistration = { |
| 49 | sizeof(FLT_REGISTRATION), // Size |
| 50 | FLT_REGISTRATION_VERSION, // Version |
| 51 | 0, // Flags |
| 52 | |
| 53 | NULL, // Context |
| 54 | Callbacks, // Operation callbacks |
| 55 | UnloadRoutine, |
| 56 | |
| 57 | FSBlockingFilter::HandleInstanceSetup, |
| 58 | FSBlockingFilter::HandleInstanceQueryTeardown, |
| 59 | FSBlockingFilter::HandleInstanceTeardownStart, |
| 60 | FSBlockingFilter::HandleInstanceTeardownComplete, |
| 61 | |
| 62 | NULL, // GenerateFileName |
| 63 | NULL, // GenerateDestinationFileName |
| 64 | NULL // NormalizeNameComponent |
| 65 | }; |
| 66 | |
| 67 | // |
| 68 | // Register with FltMgr to tell it our callback routines. |
| 69 | // |
| 70 | *InitializeStatus = FltRegisterFilter(DriverObject, &FilterRegistration, FilterHandle); |
| 71 | |
| 72 | FLT_ASSERT(NT_SUCCESS(*InitializeStatus)); |
| 73 | |
| 74 | // |
| 75 | // Start filtering. |
| 76 | // |
| 77 | *InitializeStatus = FltStartFiltering(*FilterHandle); |
| 78 | |
| 79 | // |
| 80 | // If we can't start filtering, unregister the filter. |
nothing calls this directly
no test coverage detected