Minifilter and IRP_MJ_DIRECTORY_CONTROL post op

[Dato0011]

Hello

I'm trying to intercept calls to FindFirstFile/ZwQueryDirectoryFile from a specific application from Minifilter. The goal is for the application to see a folder that doesn't exist. So if the app enumerates files and folders from an empty folder C:\Temp, that application shouldn't see that the folder is empty, instead it should see a folder in that directory (that I will provide in output result).

Now I understand that I need to modify DirectoryBuffer or Mdl buffer pointed by MdlAddress. Basically I need to return one more FILE_BOTH_DIR_INFORMATION structure instance to the caller. Problem is that those buffers comes with fixed size, so I can not add anything in them.

So my question is:

1. What options do I have. Should I allocate a larger memory from non-paged pool and replace the DirectoryBuffer pointer in post operation (same with Mdl)? Will the caller be able to access that memory?

2. If so, what should I do with original buffer, should I free it?

3. If not how can I return a larger buffer to the caller in user mode?


Thanks

Continue reading...