Filter Manager Concepts: Part 3 – FLT_FILTER

Well, as you have probably guessed, FLT_FILTER is a structure that describes a minifilter. It is a pretty important structure and people usually become familiar with it once they discover that their minifilter is not unloading, which invariably happens at some point during development. In the grand scheme of things the FLT_FILTER is very similar…


Filter Manager Concepts: Part 2 – FLT_VOLUME

Right below the FLTP_FRAME in the hierarchy of filter manager objects is the FLT_VOLUME. It is a structure that describes the attachment of the FLTP_FRAME to a volume: So, as you can see, each frame is pretty much a list of volumes. These volumes are in fact DEVICE_OBJECTs with which FltMgr attaches to each IO…


Filter Manager Concepts: Part 1 – FLTP_FRAME

Filter Manager’s only purpose is to simplify writing file system filters and sometimes it does this by abstracting some of the things that a filter needs to deal with. However, in my experience a good understanding of the mechanisms behind any abstraction is worth having as there usually are some corner cases where abstractions are…

4

Ello, ello… What’s all this, then !?

  The main focus of this blog is development of file system filters. I’m not sure how many people are interested in this particular subject, but for those brave few souls things are, in my opinion, unnecessarily complicated. The documentation is rather minimal, the semantics are counterintuitive and even the basic concepts aren’t very clear…

3