Minifilter driver: how to replace file content on open?

I have a top-level minifilter driver and a user-mode service, which is similar to the Scanner MSDN example.

I want my user-mode service to replace the

A.txt

file contents, when it's opened in the Notepad.

So, in the

IRP_MJ_CREATE

post-operation callback I'm sending notification to the service and waiting for it to write a new data to the file.

But service cannot open the

A.txt

, because it's already locked by notepad.

How to allow my service to write the data without using the kernel FltWriteFile?

What is the best way of doing this?

Maybe cancel file open, letting service write data and reopen it with the same parameters without leaving the post-operation callback?

Maybe I should overwrite the desired access in the pre-op?

---

Any info will be appreciated. If you think this question lacks of details, please, let me know.

Rohan

Answer Source

Instead of notifying to your service in on PostOperation, do that in PreOperation callback. By the time you do that in PostOperation file will be already opened for Notepad.exe, which is why open in your service is failing.

Also, if you are not doing already, you would have to wait in PreOperation while your service writes new data to the file.

Minifilter driver: how to replace file content on open?

Sign up