5

I am writing a mini-filter code for USB (Flash Drives) for blocking i.e (Access Denied).So, could someone help me out, how to detect or block USB or what methods to use in passThrough WDK sample code for USB detection and USB blocking?

I am trying to use *IOCTL_STORAGE_QUERY_PROPERTY in PFLT_INSTANCE_SETUP_CALLBACK*. Am i on right path?? if yes then how to use IOCTL_STORAGE_QUERY_PROPERTY in PFLT_INSTANCE_SETUP_CALLBACK???

Jamey Sharp
  • 8,363
  • 2
  • 29
  • 42
suraj_fale
  • 978
  • 2
  • 21
  • 53

2 Answers2

3

After 3 months of work I have finally achieved blocking. Though I can't give direct code here. But following link might help.

PassThrough Development

GitHub Link

suraj_fale
  • 978
  • 2
  • 21
  • 53
1

One way could be to get the device object using FltGetDiskDeviceObject and then check for FILE_REMOVABLE_MEDIA flag in device_object->Characteristics. Once you get to know about the device type, then you can block or allow the required operations (that you need to register with FLT_OPERATION_REGISTRATION).

Vikram.exe
  • 4,565
  • 3
  • 29
  • 40
  • ya i have tried it. But it won't work. Can you explain me in detail, probably with a code? – suraj_fale Jan 22 '11 at 07:53
  • Is there any other way like bu using FltCreateFile method? Because i know that it can be used to block access to files. But i don't know for a Volume? – suraj_fale Jan 22 '11 at 07:56