Part 1: Fs Minifilter Hooking

Filter Manager Internals

From the blog Of Filesystems And Other Demons
From msdn.
As you can see each index in the array represents another MajorFunction (Index = MajorFunction + 0x16h).
Only the fields in black belong to CALLBACK_NODE.

Invoking Minifilter Callbacks

How we can extract the list of callbacks?

How To Hook a FS Minifilter?

The result

References

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store