Method HandlePreWriteOperation

PeaceMaker Kernel/FSFilter.cpp:235–318

This function is called prior to a write operation. Data - The data associated with the current operation. FltObjects - Objects related to the filter, instance, and its associated volume. CompletionContext - Optional context to be passed to post operation callbacks. */

	CompletionContext - Optional context to be passed to post operation callbacks.
*/
FLT_PREOP_CALLBACK_STATUS
FSBlockingFilter::HandlePreWriteOperation(
	_Inout_ PFLT_CALLBACK_DATA Data,
	_In_ PCFLT_RELATED_OBJECTS FltObjects,
	_Flt_CompletionContext_Outptr_ PVOID* CompletionContext
	)
{
	FLT_PREOP_CALLBACK_STATUS callbackStatus;
	PFLT_FILE_NAME_INFORMATION fileNameInfo;

	PUNICODE_STRING callerProcessPath;
	PSTACK_RETURN_INFO fileOperationStack;
	ULONG fileOperationStackSize;
	BOOLEAN reportOperation;

	UNREFERENCED_PARAMETER(FltObjects);
	UNREFERENCED_PARAMETER(CompletionContext);

	reportOperation = FALSE;
	fileOperationStackSize = MAX_STACK_RETURN_HISTORY;
	fileNameInfo = NULL;
	callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;

	//
	// PeaceMaker is not designed to block kernel operations.
	//
	if (ExGetPreviousMode() == KernelMode)
	{
		return callbackStatus;
	}

	if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &fileNameInfo)))
	{
		if (FSBlockingFilter::FileStringFilters->MatchesFilter(fileNameInfo->Name.Buffer, FILTER_FLAG_WRITE) != FALSE)
		{
			DBGPRINT("FSBlockingFilter!HandlePreWriteOperation: Detected write on %wZ. Prevented write!", fileNameInfo->Name);
			Data->Iopb->TargetFileObject->DeletePending = FALSE;
			Data->IoStatus.Information = 0;
			Data->IoStatus.Status = STATUS_ACCESS_DENIED;
			callbackStatus = FLT_PREOP_COMPLETE;
			reportOperation = TRUE;
		}
	}

	if (reportOperation)
	{
		//
		// Grab the caller's path.
		//
		ImageHistoryFilter::GetProcessImageFileName(PsGetCurrentProcessId(), &callerProcessPath);

		//
		// Walk the stack.
		//
		FSBlockingFilter::walker.WalkAndResolveStack(&fileOperationStack, &fileOperationStackSize, STACK_HISTORY_TAG);

		NT_ASSERT(fileOperationStack);