Hello,
I have written small NtCreateFile intercepter (legacy driver). It will a filter with a list of denied files.
But I have a problem with paths to files.
The problem is in the next: windows has a several types for paths (DOS path, UNC, using symbolic links, etc). For example, I have seen these variants:
- ??C:dirfile.ext
- DosDevicesC:dirfile.ext
- GLOBAL??C:dirfile.ext
- DeviceHarddisk0Partition1dirfile.ext
- DeviceHarddiskVolume1dirfile.ext
- ??C:WINDOWSsystem32shell32.dll
- DeviceLanmanRedirectorPHILKALINEAGE II - INTERLUDE (shared resource on PHILKA)
- ??UNCPHILKALINEAGE II - INTERLUDE (again)
- DEVICEHARDDISKVOLUME2PROGRAM FILESDEBUGVIEWDBGVIEW.EXE (starting app)
As you can see, there are different variants to call a file.
How can I support all these types? Is it possible to reduce all these types to one (any one)?
Thank you.