├── README.md
├── minivers Package
    ├── minivers Package.vcxproj
    └── minivers Package.vcxproj.filters
├── minivers.sln
└── minivers
    ├── RegistrationData.c
    ├── copy_file.c
    ├── copy_file.h
    ├── minivers.c
    ├── minivers.h
    ├── minivers.inf
    ├── minivers.rc
    ├── minivers.vcxproj
    └── minivers.vcxproj.filters


/README.md:
--------------------------------------------------------------------------------
 1 | Minivers File System Minifilter Driver
 2 | ======================================
 3 | 
 4 | Minivers is a Windows file system minifilter driver which monitors changes in files with certain extensions. If a monitored file is about to be changed, deleted or renamed, a backup copy of the file is performed before the operation begins.
 5 | 
 6 | The file name of the backup files has the format:
 7 | ```
 8 | <original-filename>.YYYYMMDD_hhmmss_mmm.minivers
 9 | ```
10 | 
11 | 
12 | The following file extensions are monitored:
13 | * doc
14 | * docx
15 | * xls
16 | * xlsx
17 | * txt
18 | 
19 | You can add more file extensions by editing the file minivers.c:
20 | ```
21 | /******************************************************************************
22 |  ******************************************************************************
23 |  **                                                                          **
24 |  ** File extensions to be taken into account.                                **
25 |  **                                                                          **
26 |  ******************************************************************************
27 |  ******************************************************************************/
28 | DECLARE_CONST_UNICODE_STRING(DOC, L"doc");
29 | DECLARE_CONST_UNICODE_STRING(DOCX, L"docx");
30 | DECLARE_CONST_UNICODE_STRING(XLS, L"xls");
31 | DECLARE_CONST_UNICODE_STRING(XLSX, L"xlsx");
32 | DECLARE_CONST_UNICODE_STRING(TXT, L"txt");
33 |  
34 | static const UNICODE_STRING* extensions[] = {&DOC, &DOCX, &XLS, &XLSX, &TXT};
35 | ```
36 | 
37 | 
38 | The backup files have the extension `minivers`:
39 | ```
40 | DECLARE_CONST_UNICODE_STRING(MINIVERS_EXT, L"minivers");
41 | ```
42 | 
43 | 
44 | Files with this file extension cannot be deleted, if you want to change this, change the following `define`:
45 | ```
46 | #define IMMUTABLE_BACKUP_FILES TRUE
47 | ```
48 | 
49 | 
50 | Minivers can be used to protect against ransomware, as they search files with certain extensions (not tested though).
51 | 
52 | Minivers logs the name of the executable which produced the change, to avoid this change the following `define`:
53 | ```
54 | #define LOG_IMAGE_FILENAME     TRUE
55 | ```
56 | 


--------------------------------------------------------------------------------
/minivers Package/minivers Package.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Win8.1 Debug|Win32">
  5 |       <Configuration>Win8.1 Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Win8.1 Release|Win32">
  9 |       <Configuration>Win8.1 Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Win8 Debug|Win32">
 13 |       <Configuration>Win8 Debug</Configuration>
 14 |       <Platform>Win32</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Win8 Release|Win32">
 17 |       <Configuration>Win8 Release</Configuration>
 18 |       <Platform>Win32</Platform>
 19 |     </ProjectConfiguration>
 20 |     <ProjectConfiguration Include="Win7 Debug|Win32">
 21 |       <Configuration>Win7 Debug</Configuration>
 22 |       <Platform>Win32</Platform>
 23 |     </ProjectConfiguration>
 24 |     <ProjectConfiguration Include="Win7 Release|Win32">
 25 |       <Configuration>Win7 Release</Configuration>
 26 |       <Platform>Win32</Platform>
 27 |     </ProjectConfiguration>
 28 |     <ProjectConfiguration Include="Win8.1 Debug|x64">
 29 |       <Configuration>Win8.1 Debug</Configuration>
 30 |       <Platform>x64</Platform>
 31 |     </ProjectConfiguration>
 32 |     <ProjectConfiguration Include="Win8.1 Release|x64">
 33 |       <Configuration>Win8.1 Release</Configuration>
 34 |       <Platform>x64</Platform>
 35 |     </ProjectConfiguration>
 36 |     <ProjectConfiguration Include="Win8 Debug|x64">
 37 |       <Configuration>Win8 Debug</Configuration>
 38 |       <Platform>x64</Platform>
 39 |     </ProjectConfiguration>
 40 |     <ProjectConfiguration Include="Win8 Release|x64">
 41 |       <Configuration>Win8 Release</Configuration>
 42 |       <Platform>x64</Platform>
 43 |     </ProjectConfiguration>
 44 |     <ProjectConfiguration Include="Win7 Debug|x64">
 45 |       <Configuration>Win7 Debug</Configuration>
 46 |       <Platform>x64</Platform>
 47 |     </ProjectConfiguration>
 48 |     <ProjectConfiguration Include="Win7 Release|x64">
 49 |       <Configuration>Win7 Release</Configuration>
 50 |       <Platform>x64</Platform>
 51 |     </ProjectConfiguration>
 52 |   </ItemGroup>
 53 |   <PropertyGroup Label="Globals">
 54 |     <ProjectGuid>{305D7A16-455C-4019-946A-7CBFFC6508D1}</ProjectGuid>
 55 |     <TemplateGuid>{4605da2c-74a5-4865-98e1-152ef136825f}</TemplateGuid>
 56 |     <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
 57 |     <MinimumVisualStudioVersion>11.0</MinimumVisualStudioVersion>
 58 |     <Configuration>Win8.1 Debug</Configuration>
 59 |     <Platform Condition="'$(Platform)' == ''">Win32</Platform>
 60 |     <RootNamespace>minivers_Package</RootNamespace>
 61 |   </PropertyGroup>
 62 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 63 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|Win32'" Label="Configuration">
 64 |     <TargetVersion>WindowsV6.3</TargetVersion>
 65 |     <UseDebugLibraries>true</UseDebugLibraries>
 66 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 67 |     <ConfigurationType>Utility</ConfigurationType>
 68 |     <DriverType>Package</DriverType>
 69 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
 70 |   </PropertyGroup>
 71 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|Win32'" Label="Configuration">
 72 |     <TargetVersion>WindowsV6.3</TargetVersion>
 73 |     <UseDebugLibraries>false</UseDebugLibraries>
 74 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 75 |     <ConfigurationType>Utility</ConfigurationType>
 76 |     <DriverType>Package</DriverType>
 77 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|Win32'" Label="Configuration">
 80 |     <TargetVersion>Windows8</TargetVersion>
 81 |     <UseDebugLibraries>true</UseDebugLibraries>
 82 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 83 |     <ConfigurationType>Utility</ConfigurationType>
 84 |     <DriverType>Package</DriverType>
 85 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
 86 |   </PropertyGroup>
 87 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|Win32'" Label="Configuration">
 88 |     <TargetVersion>Windows8</TargetVersion>
 89 |     <UseDebugLibraries>false</UseDebugLibraries>
 90 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 91 |     <ConfigurationType>Utility</ConfigurationType>
 92 |     <DriverType>Package</DriverType>
 93 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
 94 |   </PropertyGroup>
 95 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'" Label="Configuration">
 96 |     <TargetVersion>Windows7</TargetVersion>
 97 |     <UseDebugLibraries>true</UseDebugLibraries>
 98 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 99 |     <ConfigurationType>Utility</ConfigurationType>
100 |     <DriverType>Package</DriverType>
101 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
102 |   </PropertyGroup>
103 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'" Label="Configuration">
104 |     <TargetVersion>Windows7</TargetVersion>
105 |     <UseDebugLibraries>false</UseDebugLibraries>
106 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
107 |     <ConfigurationType>Utility</ConfigurationType>
108 |     <DriverType>Package</DriverType>
109 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
110 |   </PropertyGroup>
111 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|x64'" Label="Configuration">
112 |     <TargetVersion>WindowsV6.3</TargetVersion>
113 |     <UseDebugLibraries>true</UseDebugLibraries>
114 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
115 |     <ConfigurationType>Utility</ConfigurationType>
116 |     <DriverType>Package</DriverType>
117 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
118 |   </PropertyGroup>
119 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|x64'" Label="Configuration">
120 |     <TargetVersion>WindowsV6.3</TargetVersion>
121 |     <UseDebugLibraries>false</UseDebugLibraries>
122 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
123 |     <ConfigurationType>Utility</ConfigurationType>
124 |     <DriverType>Package</DriverType>
125 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
126 |   </PropertyGroup>
127 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|x64'" Label="Configuration">
128 |     <TargetVersion>Windows8</TargetVersion>
129 |     <UseDebugLibraries>true</UseDebugLibraries>
130 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
131 |     <ConfigurationType>Utility</ConfigurationType>
132 |     <DriverType>Package</DriverType>
133 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
134 |   </PropertyGroup>
135 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|x64'" Label="Configuration">
136 |     <TargetVersion>Windows8</TargetVersion>
137 |     <UseDebugLibraries>false</UseDebugLibraries>
138 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
139 |     <ConfigurationType>Utility</ConfigurationType>
140 |     <DriverType>Package</DriverType>
141 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
142 |   </PropertyGroup>
143 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'" Label="Configuration">
144 |     <TargetVersion>Windows7</TargetVersion>
145 |     <UseDebugLibraries>true</UseDebugLibraries>
146 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
147 |     <ConfigurationType>Utility</ConfigurationType>
148 |     <DriverType>Package</DriverType>
149 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
150 |   </PropertyGroup>
151 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'" Label="Configuration">
152 |     <TargetVersion>Windows7</TargetVersion>
153 |     <UseDebugLibraries>false</UseDebugLibraries>
154 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
155 |     <ConfigurationType>Utility</ConfigurationType>
156 |     <DriverType>Package</DriverType>
157 |     <DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
158 |   </PropertyGroup>
159 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
160 |   <ImportGroup Label="ExtensionSettings">
161 |   </ImportGroup>
162 |   <ImportGroup Label="PropertySheets">
163 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
164 |   </ImportGroup>
165 |   <PropertyGroup Label="UserMacros" />
166 |   <PropertyGroup />
167 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|Win32'">
168 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
169 |     <EnableDeployment>False</EnableDeployment>
170 |     <RemoveDriver>True</RemoveDriver>
171 |     <HardwareIdString />
172 |     <CommandLine />
173 |     <DeployFiles />
174 |     <EnableVerifier>False</EnableVerifier>
175 |     <AllDrivers>False</AllDrivers>
176 |     <VerifyProjectOutput>True</VerifyProjectOutput>
177 |     <VerifyDrivers />
178 |     <VerifyFlags>133563</VerifyFlags>
179 |   </PropertyGroup>
180 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|Win32'">
181 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
182 |     <EnableDeployment>False</EnableDeployment>
183 |     <RemoveDriver>True</RemoveDriver>
184 |     <HardwareIdString />
185 |     <CommandLine />
186 |     <DeployFiles />
187 |     <EnableVerifier>False</EnableVerifier>
188 |     <AllDrivers>False</AllDrivers>
189 |     <VerifyProjectOutput>True</VerifyProjectOutput>
190 |     <VerifyDrivers />
191 |     <VerifyFlags>133563</VerifyFlags>
192 |   </PropertyGroup>
193 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|Win32'">
194 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
195 |     <EnableDeployment>False</EnableDeployment>
196 |     <RemoveDriver>True</RemoveDriver>
197 |     <HardwareIdString />
198 |     <CommandLine />
199 |     <DeployFiles />
200 |     <EnableVerifier>False</EnableVerifier>
201 |     <AllDrivers>False</AllDrivers>
202 |     <VerifyProjectOutput>True</VerifyProjectOutput>
203 |     <VerifyDrivers />
204 |     <VerifyFlags>133563</VerifyFlags>
205 |   </PropertyGroup>
206 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|Win32'">
207 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
208 |     <EnableDeployment>False</EnableDeployment>
209 |     <RemoveDriver>True</RemoveDriver>
210 |     <HardwareIdString />
211 |     <CommandLine />
212 |     <DeployFiles />
213 |     <EnableVerifier>False</EnableVerifier>
214 |     <AllDrivers>False</AllDrivers>
215 |     <VerifyProjectOutput>True</VerifyProjectOutput>
216 |     <VerifyDrivers />
217 |     <VerifyFlags>133563</VerifyFlags>
218 |   </PropertyGroup>
219 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'">
220 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
221 |     <EnableDeployment>False</EnableDeployment>
222 |     <RemoveDriver>True</RemoveDriver>
223 |     <HardwareIdString />
224 |     <CommandLine />
225 |     <DeployFiles />
226 |     <EnableVerifier>False</EnableVerifier>
227 |     <AllDrivers>False</AllDrivers>
228 |     <VerifyProjectOutput>True</VerifyProjectOutput>
229 |     <VerifyDrivers />
230 |     <VerifyFlags>133563</VerifyFlags>
231 |   </PropertyGroup>
232 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'">
233 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
234 |     <EnableDeployment>False</EnableDeployment>
235 |     <RemoveDriver>True</RemoveDriver>
236 |     <HardwareIdString />
237 |     <CommandLine />
238 |     <DeployFiles />
239 |     <EnableVerifier>False</EnableVerifier>
240 |     <AllDrivers>False</AllDrivers>
241 |     <VerifyProjectOutput>True</VerifyProjectOutput>
242 |     <VerifyDrivers />
243 |     <VerifyFlags>133563</VerifyFlags>
244 |   </PropertyGroup>
245 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|x64'">
246 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
247 |     <EnableDeployment>False</EnableDeployment>
248 |     <RemoveDriver>True</RemoveDriver>
249 |     <HardwareIdString />
250 |     <CommandLine />
251 |     <DeployFiles />
252 |     <EnableVerifier>False</EnableVerifier>
253 |     <AllDrivers>False</AllDrivers>
254 |     <VerifyProjectOutput>True</VerifyProjectOutput>
255 |     <VerifyDrivers />
256 |     <VerifyFlags>133563</VerifyFlags>
257 |   </PropertyGroup>
258 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|x64'">
259 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
260 |     <EnableDeployment>False</EnableDeployment>
261 |     <RemoveDriver>True</RemoveDriver>
262 |     <HardwareIdString />
263 |     <CommandLine />
264 |     <DeployFiles />
265 |     <EnableVerifier>False</EnableVerifier>
266 |     <AllDrivers>False</AllDrivers>
267 |     <VerifyProjectOutput>True</VerifyProjectOutput>
268 |     <VerifyDrivers />
269 |     <VerifyFlags>133563</VerifyFlags>
270 |   </PropertyGroup>
271 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|x64'">
272 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
273 |     <EnableDeployment>False</EnableDeployment>
274 |     <RemoveDriver>True</RemoveDriver>
275 |     <HardwareIdString />
276 |     <CommandLine />
277 |     <DeployFiles />
278 |     <EnableVerifier>False</EnableVerifier>
279 |     <AllDrivers>False</AllDrivers>
280 |     <VerifyProjectOutput>True</VerifyProjectOutput>
281 |     <VerifyDrivers />
282 |     <VerifyFlags>133563</VerifyFlags>
283 |   </PropertyGroup>
284 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|x64'">
285 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
286 |     <EnableDeployment>False</EnableDeployment>
287 |     <RemoveDriver>True</RemoveDriver>
288 |     <HardwareIdString />
289 |     <CommandLine />
290 |     <DeployFiles />
291 |     <EnableVerifier>False</EnableVerifier>
292 |     <AllDrivers>False</AllDrivers>
293 |     <VerifyProjectOutput>True</VerifyProjectOutput>
294 |     <VerifyDrivers />
295 |     <VerifyFlags>133563</VerifyFlags>
296 |   </PropertyGroup>
297 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'">
298 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
299 |     <EnableDeployment>False</EnableDeployment>
300 |     <RemoveDriver>True</RemoveDriver>
301 |     <HardwareIdString />
302 |     <CommandLine />
303 |     <DeployFiles />
304 |     <EnableVerifier>False</EnableVerifier>
305 |     <AllDrivers>False</AllDrivers>
306 |     <VerifyProjectOutput>True</VerifyProjectOutput>
307 |     <VerifyDrivers />
308 |     <VerifyFlags>133563</VerifyFlags>
309 |   </PropertyGroup>
310 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'">
311 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
312 |     <EnableDeployment>False</EnableDeployment>
313 |     <RemoveDriver>True</RemoveDriver>
314 |     <HardwareIdString />
315 |     <CommandLine />
316 |     <DeployFiles />
317 |     <EnableVerifier>False</EnableVerifier>
318 |     <AllDrivers>False</AllDrivers>
319 |     <VerifyProjectOutput>True</VerifyProjectOutput>
320 |     <VerifyDrivers />
321 |     <VerifyFlags>133563</VerifyFlags>
322 |   </PropertyGroup>
323 |   <ItemGroup>
324 |     <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
325 |   </ItemGroup>
326 |   <ItemGroup>
327 |     <ProjectReference Include="..\minivers\minivers.vcxproj">
328 |       <Project>{e337ac23-f84d-4e6d-81e9-729f64684a30}</Project>
329 |     </ProjectReference>
330 |   </ItemGroup>
331 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
332 |   <ImportGroup Label="ExtensionTargets">
333 |   </ImportGroup>
334 | </Project>


--------------------------------------------------------------------------------
/minivers Package/minivers Package.vcxproj.filters:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <ItemGroup>
4 |     <Filter Include="Driver Files">
5 |       <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
6 |       <Extensions>inf;inv;inx;mof;mc;</Extensions>
7 |     </Filter>
8 |   </ItemGroup>
9 | </Project>


--------------------------------------------------------------------------------
/minivers.sln:
--------------------------------------------------------------------------------
  1 | 
  2 | Microsoft Visual Studio Solution File, Format Version 12.00
  3 | # Visual Studio Express 2013 for Windows Desktop
  4 | VisualStudioVersion = 12.0.31101.0
  5 | MinimumVisualStudioVersion = 10.0.40219.1
  6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "minivers", "minivers\minivers.vcxproj", "{E337AC23-F84D-4E6D-81E9-729F64684A30}"
  7 | EndProject
  8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "minivers Package", "minivers Package\minivers Package.vcxproj", "{305D7A16-455C-4019-946A-7CBFFC6508D1}"
  9 | 	ProjectSection(ProjectDependencies) = postProject
 10 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30} = {E337AC23-F84D-4E6D-81E9-729F64684A30}
 11 | 	EndProjectSection
 12 | EndProject
 13 | Global
 14 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 15 | 		Win7 Debug|Win32 = Win7 Debug|Win32
 16 | 		Win7 Debug|x64 = Win7 Debug|x64
 17 | 		Win7 Release|Win32 = Win7 Release|Win32
 18 | 		Win7 Release|x64 = Win7 Release|x64
 19 | 		Win8 Debug|Win32 = Win8 Debug|Win32
 20 | 		Win8 Debug|x64 = Win8 Debug|x64
 21 | 		Win8 Release|Win32 = Win8 Release|Win32
 22 | 		Win8 Release|x64 = Win8 Release|x64
 23 | 		Win8.1 Debug|Win32 = Win8.1 Debug|Win32
 24 | 		Win8.1 Debug|x64 = Win8.1 Debug|x64
 25 | 		Win8.1 Release|Win32 = Win8.1 Release|Win32
 26 | 		Win8.1 Release|x64 = Win8.1 Release|x64
 27 | 	EndGlobalSection
 28 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 29 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|Win32.ActiveCfg = Win7 Debug|Win32
 30 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|Win32.Build.0 = Win7 Debug|Win32
 31 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|Win32.Deploy.0 = Win7 Debug|Win32
 32 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|x64.ActiveCfg = Win7 Debug|x64
 33 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|x64.Build.0 = Win7 Debug|x64
 34 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Debug|x64.Deploy.0 = Win7 Debug|x64
 35 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|Win32.ActiveCfg = Win7 Release|Win32
 36 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|Win32.Build.0 = Win7 Release|Win32
 37 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|Win32.Deploy.0 = Win7 Release|Win32
 38 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|x64.ActiveCfg = Win7 Release|x64
 39 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|x64.Build.0 = Win7 Release|x64
 40 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win7 Release|x64.Deploy.0 = Win7 Release|x64
 41 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|Win32.ActiveCfg = Win8 Debug|Win32
 42 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|Win32.Build.0 = Win8 Debug|Win32
 43 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|Win32.Deploy.0 = Win8 Debug|Win32
 44 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|x64.ActiveCfg = Win8 Debug|x64
 45 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|x64.Build.0 = Win8 Debug|x64
 46 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Debug|x64.Deploy.0 = Win8 Debug|x64
 47 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|Win32.ActiveCfg = Win8 Release|Win32
 48 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|Win32.Build.0 = Win8 Release|Win32
 49 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|Win32.Deploy.0 = Win8 Release|Win32
 50 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|x64.ActiveCfg = Win8 Release|x64
 51 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|x64.Build.0 = Win8 Release|x64
 52 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8 Release|x64.Deploy.0 = Win8 Release|x64
 53 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|Win32.ActiveCfg = Win8.1 Debug|Win32
 54 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|Win32.Build.0 = Win8.1 Debug|Win32
 55 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|Win32.Deploy.0 = Win8.1 Debug|Win32
 56 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|x64.ActiveCfg = Win8.1 Debug|x64
 57 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|x64.Build.0 = Win8.1 Debug|x64
 58 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Debug|x64.Deploy.0 = Win8.1 Debug|x64
 59 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|Win32.ActiveCfg = Win8.1 Release|Win32
 60 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|Win32.Build.0 = Win8.1 Release|Win32
 61 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|Win32.Deploy.0 = Win8.1 Release|Win32
 62 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|x64.ActiveCfg = Win8.1 Release|x64
 63 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|x64.Build.0 = Win8.1 Release|x64
 64 | 		{E337AC23-F84D-4E6D-81E9-729F64684A30}.Win8.1 Release|x64.Deploy.0 = Win8.1 Release|x64
 65 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|Win32.ActiveCfg = Win7 Debug|Win32
 66 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|Win32.Build.0 = Win7 Debug|Win32
 67 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|Win32.Deploy.0 = Win7 Debug|Win32
 68 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|x64.ActiveCfg = Win7 Debug|x64
 69 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|x64.Build.0 = Win7 Debug|x64
 70 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Debug|x64.Deploy.0 = Win7 Debug|x64
 71 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|Win32.ActiveCfg = Win7 Release|Win32
 72 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|Win32.Build.0 = Win7 Release|Win32
 73 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|Win32.Deploy.0 = Win7 Release|Win32
 74 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|x64.ActiveCfg = Win7 Release|x64
 75 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|x64.Build.0 = Win7 Release|x64
 76 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win7 Release|x64.Deploy.0 = Win7 Release|x64
 77 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|Win32.ActiveCfg = Win8 Debug|Win32
 78 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|Win32.Build.0 = Win8 Debug|Win32
 79 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|Win32.Deploy.0 = Win8 Debug|Win32
 80 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|x64.ActiveCfg = Win8 Debug|x64
 81 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|x64.Build.0 = Win8 Debug|x64
 82 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Debug|x64.Deploy.0 = Win8 Debug|x64
 83 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|Win32.ActiveCfg = Win8 Release|Win32
 84 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|Win32.Build.0 = Win8 Release|Win32
 85 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|Win32.Deploy.0 = Win8 Release|Win32
 86 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|x64.ActiveCfg = Win8 Release|x64
 87 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|x64.Build.0 = Win8 Release|x64
 88 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8 Release|x64.Deploy.0 = Win8 Release|x64
 89 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|Win32.ActiveCfg = Win8.1 Debug|Win32
 90 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|Win32.Build.0 = Win8.1 Debug|Win32
 91 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|Win32.Deploy.0 = Win8.1 Debug|Win32
 92 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|x64.ActiveCfg = Win8.1 Debug|x64
 93 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|x64.Build.0 = Win8.1 Debug|x64
 94 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Debug|x64.Deploy.0 = Win8.1 Debug|x64
 95 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|Win32.ActiveCfg = Win8.1 Release|Win32
 96 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|Win32.Build.0 = Win8.1 Release|Win32
 97 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|Win32.Deploy.0 = Win8.1 Release|Win32
 98 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|x64.ActiveCfg = Win8.1 Release|x64
 99 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|x64.Build.0 = Win8.1 Release|x64
100 | 		{305D7A16-455C-4019-946A-7CBFFC6508D1}.Win8.1 Release|x64.Deploy.0 = Win8.1 Release|x64
101 | 	EndGlobalSection
102 | 	GlobalSection(SolutionProperties) = preSolution
103 | 		HideSolutionNode = FALSE
104 | 	EndGlobalSection
105 | EndGlobal
106 | 


--------------------------------------------------------------------------------
/minivers/RegistrationData.c:
--------------------------------------------------------------------------------
 1 | #include "minivers.h"
 2 | 
 3 | /* Place all the following DATA and CONSTANT DATA in the INIT segment. */
 4 | #ifdef ALLOC_DATA_PRAGMA
 5 |   #pragma data_seg("INIT")
 6 |   #pragma const_seg("INIT")
 7 | #endif /* ALLOC_DATA_PRAGMA */
 8 | 
 9 | CONST FLT_OPERATION_REGISTRATION callbacks[] = {
10 |   {IRP_MJ_CREATE,          0, PreOperationCallback, NULL},
11 |   {IRP_MJ_SET_INFORMATION, 0, PreOperationCallback, NULL},
12 |   {IRP_MJ_OPERATION_END                                 }
13 | };
14 | 
15 | CONST FLT_REGISTRATION filter_registration = {
16 |   sizeof(FLT_REGISTRATION),             /* Size. */
17 |   FLT_REGISTRATION_VERSION,             /* Version. */
18 |   0,                                    /* Flags. */
19 |   NULL,                                 /* ContextRegistration. */
20 |   callbacks,                            /* OperationRegistration. */
21 |   FilterUnload,                         /* FilterUnloadCallback. */
22 |   InstanceSetup,                        /* InstanceSetupCallback. */
23 |   InstanceQueryTeardown,                /* InstanceQueryTeardownCallback. */
24 |   NULL,                                 /* InstanceTeardownStartCallback. */
25 |   NULL,                                 /* InstanceTeardownCompleteCallback. */
26 |   NULL,                                 /* GenerateFileNameCallback. */
27 |   NULL,                                 /* NormalizeNameComponentCallback. */
28 |   NULL                                  /* NormalizeContextCleanupCallback. */
29 | 
30 | #if FLT_MGR_LONGHORN
31 |   , NULL                                /* TransactionNotificationCallback. */
32 |   , NULL                                /* NormalizeNameComponentExCallback. */
33 | #endif /* FLT_MGR_LONGHORN */
34 | #if FLT_MFG_WIN8
35 |   , NULL                                /* SectionNotificationCallback. */
36 | #endif
37 | };
38 | 
39 | /* Restore the given section types back to their previous section definition. */
40 | #ifdef ALLOC_DATA_PRAGMA
41 |   #pragma data_seg()
42 |   #pragma const_seg()
43 | #endif /* ALLOC_DATA_PRAGMA */
44 | 


--------------------------------------------------------------------------------
/minivers/copy_file.c:
--------------------------------------------------------------------------------
  1 | #include <ntifs.h>
  2 | #include "copy_file.h"
  3 | #include "minivers.h"
  4 | 
  5 | #define BUFFER_SIZE (4 * 1024)
  6 | 
  7 | static BOOLEAN write(HANDLE hFile, void* buf, ULONG len);
  8 | static BOOLEAN delete_file(PFLT_INSTANCE instance, PFILE_OBJECT file);
  9 | 
 10 | /* Disable warning:
 11 |  * Conditional expression is constant:
 12 |  * do {
 13 |  *   ...
 14 |  * } while (1);
 15 |  */
 16 | #pragma warning(disable:4127)
 17 | 
 18 | BOOLEAN copy_file(PFLT_FILTER filter,
 19 |                   PFLT_INSTANCE instance,
 20 |                   UNICODE_STRING* dest,
 21 |                   UNICODE_STRING* src)
 22 | {
 23 |   HANDLE hInput, hOutput;
 24 |   PFILE_OBJECT out;
 25 |   OBJECT_ATTRIBUTES attr;
 26 |   IO_STATUS_BLOCK io_status_block;
 27 |   PVOID buf;
 28 |   ULONGLONG filesize;
 29 |   NTSTATUS status;
 30 | 
 31 |   InitializeObjectAttributes(&attr,
 32 |                              src,
 33 |                              OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
 34 |                              NULL,
 35 |                              NULL);
 36 | 
 37 |   /* Open input file for reading. */
 38 |   status = FltCreateFile(filter,                       /* Filter            */
 39 |                          instance,                     /* Instance          */
 40 |                          &hInput,                      /* FileHandle        */
 41 |                          GENERIC_READ,                 /* DesiredAccess     */
 42 |                          &attr,                        /* ObjectAttributes  */
 43 |                          &io_status_block,             /* IoStatusBlock     */
 44 |                          NULL,                         /* AllocationSize    */
 45 |                          FILE_ATTRIBUTE_NORMAL,        /* FileAttributes    */
 46 |                          FILE_SHARE_READ |             /* ShareAccess       */
 47 |                          FILE_SHARE_WRITE |
 48 |                          FILE_SHARE_DELETE,
 49 |                          FILE_OPEN,                    /* CreateDisposition */
 50 |                          FILE_SYNCHRONOUS_IO_NONALERT, /* CreateOptions     */
 51 |                          NULL,                         /* EaBuffer          */
 52 |                          0,                            /* EaLength          */
 53 |                          IO_FORCE_ACCESS_CHECK);       /* Flags             */
 54 | 
 55 |   /* If the input file could be opened... */
 56 |   if (NT_SUCCESS(status)) {
 57 |     InitializeObjectAttributes(&attr,
 58 |                                dest,
 59 |                                OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
 60 |                                NULL,
 61 |                                NULL);
 62 | 
 63 |     /* Open output file for writing. */
 64 |     status = FltCreateFileEx(filter,                       /* Filter            */
 65 |                              instance,                     /* Instance          */
 66 |                              &hOutput,                     /* FileHandle        */
 67 |                              &out,                         /* FileObject        */
 68 |                              GENERIC_WRITE,                /* DesiredAccess     */
 69 |                              &attr,                        /* ObjectAttributes  */
 70 |                              &io_status_block,             /* IoStatusBlock     */
 71 |                              NULL,                         /* AllocationSize    */
 72 |                              FILE_ATTRIBUTE_NORMAL,        /* FileAttributes    */
 73 |                              0,                            /* ShareAccess       */
 74 |                              FILE_OVERWRITE_IF,            /* CreateDisposition */
 75 |                              FILE_SYNCHRONOUS_IO_NONALERT, /* CreateOptions     */
 76 |                              NULL,                         /* EaBuffer          */
 77 |                              0,                            /* EaLength          */
 78 |                              IO_FORCE_ACCESS_CHECK);       /* Flags             */
 79 | 
 80 |     /* If the output file could be opened... */
 81 |     if (NT_SUCCESS(status)) {
 82 |       /* Allocate memory. */
 83 |       if ((buf = ExAllocatePoolWithTag(NonPagedPool,
 84 |                                        BUFFER_SIZE,
 85 |                                        TAG)) != NULL) {
 86 |         filesize = 0;
 87 | 
 88 |         do {
 89 |           /* Read from the input file. */
 90 |           status = ZwReadFile(hInput,           /* FileHandle    */
 91 |                               NULL,             /* Event         */
 92 |                               NULL,             /* ApcRoutine    */
 93 |                               NULL,             /* ApcContext    */
 94 |                               &io_status_block, /* IoStatusBlock */
 95 |                               buf,              /* Buffer        */
 96 |                               BUFFER_SIZE,      /* Length        */
 97 |                               NULL,             /* ByteOffset    */
 98 |                               NULL);            /* Key           */
 99 | 
100 |           if (NT_SUCCESS(status)) {
101 |             if (write(hOutput, buf, io_status_block.Information)) {
102 |               filesize += io_status_block.Information;
103 |             } else {
104 |               /* Free memory. */
105 |               ExFreePoolWithTag(buf, TAG);
106 | 
107 |               /* Close input file. */
108 |               FltClose(hInput);
109 | 
110 |               /* Delete output file. */
111 |               delete_file(instance, out);
112 | 
113 |               /* Close output file. */
114 |               FltClose(hOutput);
115 |               ObDereferenceObject(out);
116 | 
117 |               return FALSE;
118 |             }
119 |           } else if (status == STATUS_END_OF_FILE) {
120 |             /* Free memory. */
121 |             ExFreePoolWithTag(buf, TAG);
122 | 
123 |             /* Close input file. */
124 |             FltClose(hInput);
125 | 
126 |             /* If the file is not empty... */
127 |             if (filesize > 0) {
128 |               DbgPrint("Copied file '%wZ' -> '%wZ', filesize: %lu.",
129 |                        src,
130 |                        dest,
131 |                        filesize);
132 |             } else {
133 |               /* Delete output file. */
134 |               delete_file(instance, out);
135 |             }
136 | 
137 |             /* Close output file. */
138 |             FltClose(hOutput);
139 |             ObDereferenceObject(out);
140 | 
141 |             return TRUE;
142 |           } else {
143 |             /* Free memory. */
144 |             ExFreePoolWithTag(buf, TAG);
145 | 
146 |             /* Close input file. */
147 |             FltClose(hInput);
148 | 
149 |             /* Delete output file. */
150 |             delete_file(instance, out);
151 | 
152 |             /* Close output file. */
153 |             FltClose(hOutput);
154 |             ObDereferenceObject(out);
155 | 
156 |             return FALSE;
157 |           }
158 |         } while (1);
159 |       } else {
160 |         /* Delete output file. */
161 |         delete_file(instance, out);
162 | 
163 |         /* Close output file. */
164 |         FltClose(hOutput);
165 |         ObDereferenceObject(out);
166 |       }
167 |     }
168 | 
169 |     /* Close input file. */
170 |     FltClose(hInput);
171 |   }
172 | 
173 |   return FALSE;
174 | }
175 | 
176 | BOOLEAN write(HANDLE hFile, void* buf, ULONG len)
177 | {
178 |   IO_STATUS_BLOCK io_status_block;
179 |   UCHAR* b;
180 | 
181 |   b = (UCHAR*) buf;
182 | 
183 |   while (len > 0) {
184 |     if (!NT_SUCCESS(ZwWriteFile(hFile,            /* FileHandle    */
185 |                                 NULL,             /* Event         */
186 |                                 NULL,             /* ApcRoutine    */
187 |                                 NULL,             /* ApcContext    */
188 |                                 &io_status_block, /* IoStatusBlock */
189 |                                 b,                /* Buffer        */
190 |                                 len,              /* Length        */
191 |                                 NULL,             /* ByteOffset    */
192 |                                 NULL))) {         /* Key           */
193 |       return FALSE;
194 |     }
195 | 
196 |     b += io_status_block.Information;
197 |     len -= io_status_block.Information;
198 |   }
199 | 
200 |   return TRUE;
201 | }
202 | 
203 | BOOLEAN delete_file(PFLT_INSTANCE instance, PFILE_OBJECT file)
204 | {
205 |   FILE_DISPOSITION_INFORMATION info;
206 | 
207 |   info.DeleteFile = TRUE;
208 | 
209 |   return NT_SUCCESS(FltSetInformationFile(instance,
210 |                                           file,
211 |                                           &info,
212 |                                           sizeof(FILE_DISPOSITION_INFORMATION),
213 |                                           FileDispositionInformation));
214 | }
215 | 


--------------------------------------------------------------------------------
/minivers/copy_file.h:
--------------------------------------------------------------------------------
 1 | #ifndef COPY_FILE_H
 2 | #define COPY_FILE_H
 3 | 
 4 | #include <wdm.h>
 5 | #include <fltKernel.h>
 6 | 
 7 | BOOLEAN copy_file(PFLT_FILTER filter,
 8 |                   PFLT_INSTANCE instance,
 9 |                   UNICODE_STRING* dest,
10 |                   UNICODE_STRING* src);
11 | 
12 | #endif /* COPY_FILE_H */
13 | 


--------------------------------------------------------------------------------
/minivers/minivers.c:
--------------------------------------------------------------------------------
  1 | #include "minivers.h"
  2 | #include <ntstrsafe.h>
  3 | #include "copy_file.h"
  4 | 
  5 | #define DEFERRED_IO            TRUE
  6 | #define IMMUTABLE_BACKUP_FILES TRUE
  7 | #define LOG_IMAGE_FILENAME     TRUE
  8 | 
  9 | static DRIVER_DATA driver_data;
 10 | 
 11 | #if LOG_IMAGE_FILENAME
 12 |   #define EXE_MAX_LEN            (4 * 1024)
 13 | 
 14 |   /* Prototype of the function 'ZwQueryInformationProcess()'. */
 15 |   typedef NTSTATUS (*QueryInformationProcess)(HANDLE,
 16 |                                               PROCESSINFOCLASS,
 17 |                                               PVOID,
 18 |                                               ULONG,
 19 |                                               PULONG);
 20 | 
 21 |   /* Pointer to the function 'ZwQueryInformationProcess()'. */
 22 |   static QueryInformationProcess fnQueryInformationProcess = NULL;
 23 | #endif /* LOG_IMAGE_FILENAME */
 24 | 
 25 | 
 26 | /******************************************************************************
 27 |  ******************************************************************************
 28 |  **                                                                          **
 29 |  ** File extensions to be taken into account.                                **
 30 |  **                                                                          **
 31 |  ******************************************************************************
 32 |  ******************************************************************************/
 33 | DECLARE_CONST_UNICODE_STRING(DOC, L"doc");
 34 | DECLARE_CONST_UNICODE_STRING(DOCX, L"docx");
 35 | DECLARE_CONST_UNICODE_STRING(XLS, L"xls");
 36 | DECLARE_CONST_UNICODE_STRING(XLSX, L"xlsx");
 37 | DECLARE_CONST_UNICODE_STRING(TXT, L"txt");
 38 | 
 39 | static const UNICODE_STRING* extensions[] = {&DOC, &DOCX, &XLS, &XLSX, &TXT};
 40 | 
 41 | 
 42 | /******************************************************************************
 43 |  ******************************************************************************
 44 |  **                                                                          **
 45 |  ** minivers's file extension.                                               **
 46 |  **                                                                          **
 47 |  ******************************************************************************
 48 |  ******************************************************************************/
 49 | DECLARE_CONST_UNICODE_STRING(MINIVERS_EXT, L"minivers");
 50 | 
 51 | 
 52 | DRIVER_INITIALIZE DriverEntry;
 53 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject,
 54 |                      _In_ PUNICODE_STRING RegistryPath);
 55 | 
 56 | static NTSTATUS process_irp(PFLT_CALLBACK_DATA Data,
 57 |                             PCFLT_RELATED_OBJECTS FltObjects,
 58 |                             PVOID* CompletionContext,
 59 |                             BOOLEAN deferred_io);
 60 | 
 61 | static BOOLEAN get_file_name_information(PFLT_CALLBACK_DATA data,
 62 |                                          PFLT_FILE_NAME_INFORMATION* name_info);
 63 | 
 64 | static BOOLEAN find_extension(const UNICODE_STRING* ext);
 65 | static BOOLEAN duplicate_file(PFLT_CALLBACK_DATA CallbackData,
 66 |                               PFLT_INSTANCE instance);
 67 | 
 68 | static void deferred_io_workitem(PFLT_DEFERRED_IO_WORKITEM FltWorkItem,
 69 |                                  PFLT_CALLBACK_DATA CallbackData,
 70 |                                  PVOID Context);
 71 | 
 72 | #if LOG_IMAGE_FILENAME
 73 |   static BOOLEAN get_process_image_filename(PEPROCESS process,
 74 |                                             void* buf,
 75 |                                             size_t len);
 76 | #endif /* LOG_IMAGE_FILENAME */
 77 | 
 78 | #ifdef ALLOC_PRAGMA
 79 |   #pragma alloc_text(INIT, DriverEntry)
 80 |   #pragma alloc_text(PAGE, InstanceSetup)
 81 |   #pragma alloc_text(PAGE, FilterUnload)
 82 |   #pragma alloc_text(PAGE, InstanceQueryTeardown)
 83 | #endif /* ALLOC_PRAGMA */
 84 | 
 85 | 
 86 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject,
 87 |                      _In_ PUNICODE_STRING RegistryPath)
 88 | {
 89 | #if LOG_IMAGE_FILENAME
 90 |   UNICODE_STRING name;
 91 | #endif
 92 | 
 93 |   NTSTATUS status;
 94 | 
 95 |   UNREFERENCED_PARAMETER(RegistryPath);
 96 | 
 97 | #if LOG_IMAGE_FILENAME
 98 |   RtlInitUnicodeString(&name, L"ZwQueryInformationProcess");
 99 | 
100 |   /* Get a pointer to the function 'ZwQueryInformationProcess()'. */
101 |   fnQueryInformationProcess = (QueryInformationProcess)
102 |                               (ULONG_PTR) MmGetSystemRoutineAddress(&name);
103 | #endif /* LOG_IMAGE_FILENAME */
104 | 
105 |   /* Register with the filter manager. */
106 |   status = FltRegisterFilter(DriverObject,
107 |                              &filter_registration,
108 |                              &driver_data.filter);
109 | 
110 |   if (NT_SUCCESS(status)) {
111 |     /* Start filtering. */
112 |     status = FltStartFiltering(driver_data.filter);
113 | 
114 |     if (!NT_SUCCESS(status)) {
115 |       FltUnregisterFilter(driver_data.filter);
116 |     }
117 |   }
118 | 
119 |   return status;
120 | }
121 | 
122 | NTSTATUS InstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects,
123 |                        _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
124 |                        _In_ DEVICE_TYPE VolumeDeviceType,
125 |                        _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
126 | {
127 |   UNREFERENCED_PARAMETER(FltObjects);
128 |   UNREFERENCED_PARAMETER(Flags);
129 |   UNREFERENCED_PARAMETER(VolumeFilesystemType);
130 | 
131 |   PAGED_CODE();
132 | 
133 |   return (VolumeDeviceType != FILE_DEVICE_CD_ROM_FILE_SYSTEM) ?
134 |            STATUS_SUCCESS :
135 |            STATUS_FLT_DO_NOT_ATTACH;
136 | }
137 | 
138 | NTSTATUS FilterUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
139 | {
140 |   UNREFERENCED_PARAMETER(Flags);
141 | 
142 |   PAGED_CODE();
143 | 
144 |   FltUnregisterFilter(driver_data.filter);
145 | 
146 |   return STATUS_SUCCESS;
147 | }
148 | 
149 | NTSTATUS InstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects,
150 |                                _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
151 | {
152 |   UNREFERENCED_PARAMETER(FltObjects);
153 |   UNREFERENCED_PARAMETER(Flags);
154 | 
155 |   PAGED_CODE();
156 | 
157 |   return STATUS_SUCCESS;
158 | }
159 | 
160 | FLT_PREOP_CALLBACK_STATUS
161 | PreOperationCallback(
162 |   _Inout_ PFLT_CALLBACK_DATA Data,
163 |   _In_ PCFLT_RELATED_OBJECTS FltObjects,
164 |   _Flt_CompletionContext_Outptr_ PVOID* CompletionContext
165 | )
166 | {
167 |   /* IRP-based I/O operation? */
168 |   if (FLT_IS_IRP_OPERATION(Data)) {
169 |     /* Open file? */
170 |     if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
171 |       /* Open file for writing/appending? */
172 |       if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
173 |           (FILE_WRITE_DATA | FILE_APPEND_DATA)) {
174 |         return process_irp(Data, FltObjects, CompletionContext, DEFERRED_IO);
175 |       }
176 |     } else if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION) {
177 |       switch (Data->Iopb->Parameters.SetFileInformation.FileInformationClass) {
178 |         case FileDispositionInformation:
179 |           if (((FILE_DISPOSITION_INFORMATION*)
180 |                Data->Iopb->Parameters.SetFileInformation.InfoBuffer
181 |               )->DeleteFile) {
182 |             return process_irp(Data, FltObjects, CompletionContext, FALSE);
183 |           }
184 | 
185 |           break;
186 |         case FileEndOfFileInformation:
187 |         case FileRenameInformation:
188 |           return process_irp(Data, FltObjects, CompletionContext, FALSE);
189 |       }
190 |     }
191 |   }
192 | 
193 |   return FLT_PREOP_SUCCESS_NO_CALLBACK;
194 | }
195 | 
196 | NTSTATUS process_irp(PFLT_CALLBACK_DATA Data,
197 |                      PCFLT_RELATED_OBJECTS FltObjects,
198 |                      PVOID* CompletionContext,
199 |                      BOOLEAN deferred_io)
200 | {
201 |   PFLT_FILE_NAME_INFORMATION name_info;
202 |   PFLT_DEFERRED_IO_WORKITEM work;
203 | 
204 | #if LOG_IMAGE_FILENAME
205 |   PEPROCESS process;
206 |   ULONG pid;
207 |   char buf[sizeof(UNICODE_STRING) + (sizeof(WCHAR) * EXE_MAX_LEN)];
208 |   PUNICODE_STRING exe;
209 | #endif // LOG_IMAGE_FILENAME
210 | 
211 |   /* Get name information. */
212 |   if (get_file_name_information(Data, &name_info)) {
213 |     if (find_extension(&name_info->Extension)) {
214 | #if LOG_IMAGE_FILENAME
215 |       if (fnQueryInformationProcess) {
216 |         exe = (PUNICODE_STRING) buf;
217 |         exe->Buffer = (WCHAR*) (buf + sizeof(UNICODE_STRING));
218 |         exe->Length = 0;
219 |         exe->MaximumLength = EXE_MAX_LEN;
220 | 
221 |         /* Get process image filename. */
222 |         if (((pid = FltGetRequestorProcessId(Data)) != 0) &&
223 |             ((process = FltGetRequestorProcess(Data)) != NULL) &&
224 |             (get_process_image_filename(process, buf, sizeof(buf)))) {
225 |           DbgPrint("[PID: %u, executable: '%wZ'] Filename: '%wZ', "
226 |                    "extension: '%wZ'.",
227 |                    pid,
228 |                    exe,
229 |                    &name_info->Name,
230 |                    &name_info->Extension);
231 |         } else {
232 |           DbgPrint("Filename: '%wZ', extension: '%wZ'.",
233 |                    &name_info->Name,
234 |                    &name_info->Extension);
235 |         }
236 |       } else {
237 |         DbgPrint("Filename: '%wZ', extension: '%wZ'.",
238 |                  &name_info->Name,
239 |                  &name_info->Extension);
240 |       }
241 | #else
242 |       DbgPrint("Filename: '%wZ', extension: '%wZ'.",
243 |                &name_info->Name,
244 |                &name_info->Extension);
245 | #endif
246 | 
247 |       if (deferred_io) {
248 |         if ((work = FltAllocateDeferredIoWorkItem()) != NULL) {
249 |           if (NT_SUCCESS(FltQueueDeferredIoWorkItem(work,
250 |                                                     Data,
251 |                                                     deferred_io_workitem,
252 |                                                     DelayedWorkQueue,
253 |                                                     FltObjects->Instance))) {
254 |             FltReleaseFileNameInformation(name_info);
255 | 
256 |             *CompletionContext = NULL;
257 | 
258 |             return FLT_PREOP_PENDING;
259 |           } else {
260 |             FltFreeDeferredIoWorkItem(work);
261 |           }
262 |         }
263 |       }
264 | 
265 |       duplicate_file(Data, FltObjects->Instance);
266 | #if IMMUTABLE_BACKUP_FILES
267 |     } else if (RtlEqualUnicodeString(&name_info->Extension,
268 |                                      &MINIVERS_EXT,
269 |                                      TRUE)) {
270 |       DbgPrint("Filename: '%wZ', extension: '%wZ'.",
271 |                &name_info->Name,
272 |                &name_info->Extension);
273 | 
274 |       FltReleaseFileNameInformation(name_info);
275 | 
276 |       Data->IoStatus.Status = STATUS_ACCESS_DENIED;
277 |       return FLT_PREOP_COMPLETE;
278 | #endif /* IMMUTABLE_BACKUP_FILES */
279 |     }
280 | 
281 |     FltReleaseFileNameInformation(name_info);
282 |   }
283 | 
284 |   return FLT_PREOP_SUCCESS_NO_CALLBACK;
285 | }
286 | 
287 | BOOLEAN get_file_name_information(PFLT_CALLBACK_DATA data,
288 |                                   PFLT_FILE_NAME_INFORMATION* name_info)
289 | {
290 |   /* Get name information. */
291 |   if (NT_SUCCESS(FltGetFileNameInformation(
292 |                    data,
293 |                    FLT_FILE_NAME_NORMALIZED |
294 |                    FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
295 |                    name_info
296 |                  ))) {
297 |     /* Parse file name information. */
298 |     if (NT_SUCCESS(FltParseFileNameInformation(*name_info))) {
299 |       return TRUE;
300 |     }
301 | 
302 |     FltReleaseFileNameInformation(*name_info);
303 | #if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
304 |   } else {
305 |     /*
306 |      * We couldn't get the "normalized" name, try to get the "opened"
307 |      * name.
308 |      */
309 |     if (NT_SUCCESS(FltGetFileNameInformation(data,
310 |                      FLT_FILE_NAME_OPENED |
311 |                      FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
312 |                      name_info
313 |                    ))) {
314 |       if (NT_SUCCESS(FltParseFileNameInformation(*name_info))) {
315 |         return TRUE;
316 |       }
317 | 
318 |       FltReleaseFileNameInformation(*name_info);
319 |     }
320 | #endif /* OSVER(NTDDI_VERSION) > NTDDI_WIN2K */
321 |   }
322 | 
323 |   return FALSE;
324 | }
325 | 
326 | BOOLEAN find_extension(const UNICODE_STRING* ext)
327 | {
328 |   size_t i;
329 | 
330 |   for (i = 0; i < ARRAYSIZE(extensions); i++) {
331 |     if (RtlEqualUnicodeString(ext, extensions[i], TRUE)) {
332 |       return TRUE;
333 |     }
334 |   }
335 | 
336 |   return FALSE;
337 | }
338 | 
339 | BOOLEAN duplicate_file(PFLT_CALLBACK_DATA CallbackData, PFLT_INSTANCE instance)
340 | {
341 |   PFLT_FILE_NAME_INFORMATION name_info;
342 |   UNICODE_STRING dest;
343 |   LARGE_INTEGER system_time, local_time;
344 |   TIME_FIELDS time;
345 | 
346 |   /* Get name information. */
347 |   if (get_file_name_information(CallbackData, &name_info)) {
348 |     /* Compute size in bytes.
349 |      * Suffix's format: .YYYYMMDD_hhmmss_mmm.<MINIVERS_EXT>
350 |      */
351 |     dest.MaximumLength = name_info->Name.Length +
352 |                          42 +
353 |                          MINIVERS_EXT.Length +
354 |                          sizeof(WCHAR);
355 | 
356 |     /* Allocate memory for the destination file name. */
357 |     if ((dest.Buffer = ExAllocatePoolWithTag(NonPagedPool,
358 |                                              dest.MaximumLength,
359 |                                              TAG)) != NULL) {
360 |       dest.Length = 0;
361 | 
362 |       /* Get system time. */
363 |       KeQuerySystemTime(&system_time);
364 | 
365 |       /* Convert system time to local time. */
366 |       ExSystemTimeToLocalTime(&system_time, &local_time);
367 | 
368 |       RtlTimeToTimeFields(&local_time, &time);
369 | 
370 |       /* Compose name of the new file. */
371 |       if (NT_SUCCESS(RtlUnicodeStringPrintf(
372 |                        &dest,
373 |                        L"%wZ.%04u%02u%02u_%02u%02u%02u_%03u.%wZ",
374 |                        &name_info->Name,
375 |                        time.Year,
376 |                        time.Month,
377 |                        time.Day,
378 |                        time.Hour,
379 |                        time.Minute,
380 |                        time.Second,
381 |                        time.Milliseconds,
382 |                        &MINIVERS_EXT
383 |                      ))) {
384 |         /* Copy file. */
385 |         if (copy_file(driver_data.filter, instance, &dest, &name_info->Name)) {
386 |           ExFreePoolWithTag(dest.Buffer, TAG);
387 |           FltReleaseFileNameInformation(name_info);
388 | 
389 |           return TRUE;
390 |         }
391 |       }
392 | 
393 |       ExFreePoolWithTag(dest.Buffer, TAG);
394 |     }
395 | 
396 |     FltReleaseFileNameInformation(name_info);
397 |   }
398 | 
399 |   return FALSE;
400 | }
401 | 
402 | void deferred_io_workitem(PFLT_DEFERRED_IO_WORKITEM FltWorkItem,
403 |                           PFLT_CALLBACK_DATA CallbackData,
404 |                           PVOID Context)
405 | {
406 |   duplicate_file(CallbackData, Context);
407 | 
408 |   FltFreeDeferredIoWorkItem(FltWorkItem);
409 | 
410 |   FltCompletePendedPreOperation(CallbackData,
411 |                                 FLT_PREOP_SUCCESS_NO_CALLBACK,
412 |                                 NULL);
413 | }
414 | 
415 | #if LOG_IMAGE_FILENAME
416 |   BOOLEAN get_process_image_filename(PEPROCESS process, void* buf, size_t len)
417 |   {
418 |     HANDLE hProcess;
419 |     NTSTATUS status;
420 | 
421 |     PAGED_CODE();
422 | 
423 |     /* Get process handle. */
424 |     if (NT_SUCCESS(ObOpenObjectByPointer(process,
425 |                                          OBJ_KERNEL_HANDLE,
426 |                                          NULL,
427 |                                          0,
428 |                                          0,
429 |                                          KernelMode,
430 |                                          &hProcess))) {
431 |       /* Get process image filename. */
432 |       status = fnQueryInformationProcess(hProcess,
433 |                                          ProcessImageFileName,
434 |                                          buf,
435 |                                          len,
436 |                                          NULL);
437 | 
438 |       ZwClose(hProcess);
439 | 
440 |       return NT_SUCCESS(status) ? TRUE : FALSE;
441 |     }
442 | 
443 |     return FALSE;
444 |   }
445 | #endif /* LOG_IMAGE_FILENAME */
446 | 


--------------------------------------------------------------------------------
/minivers/minivers.h:
--------------------------------------------------------------------------------
 1 | #ifndef MINIVERS_H
 2 | #define MINIVERS_H
 3 | 
 4 | #include <fltKernel.h>
 5 | #include <suppress.h>
 6 | 
 7 | #pragma prefast(disable:__WARNING_ENCODE_MEMBER_FUNCTION_POINTER, "Not valid for kernel mode drivers")
 8 | 
 9 | #define TAG 'reVM'
10 | 
11 | 
12 | /******************************************************************************
13 |  ******************************************************************************
14 |  **                                                                          **
15 |  ** Type definitions.                                                        **
16 |  **                                                                          **
17 |  ******************************************************************************
18 |  ******************************************************************************/
19 | typedef struct {
20 |   /* The filter that results from a call to FltRegisterFilter. */
21 |   PFLT_FILTER filter;
22 | } DRIVER_DATA;
23 | 
24 | 
25 | /******************************************************************************
26 |  ******************************************************************************
27 |  **                                                                          **
28 |  ** Global variables.                                                        **
29 |  **                                                                          **
30 |  ******************************************************************************
31 |  ******************************************************************************/
32 | extern const FLT_REGISTRATION filter_registration;
33 | 
34 | 
35 | /******************************************************************************
36 |  ******************************************************************************
37 |  **                                                                          **
38 |  ** Function prototypes.                                                     **
39 |  **                                                                          **
40 |  ******************************************************************************
41 |  ******************************************************************************/
42 | FLT_PREOP_CALLBACK_STATUS
43 | PreOperationCallback(
44 |   _Inout_ PFLT_CALLBACK_DATA Data,
45 |   _In_ PCFLT_RELATED_OBJECTS FltObjects,
46 |   _Flt_CompletionContext_Outptr_ PVOID* CompletionContext
47 | );
48 | 
49 | NTSTATUS InstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects,
50 |                        _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
51 |                        _In_ DEVICE_TYPE VolumeDeviceType,
52 |                        _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType);
53 | 
54 | NTSTATUS FilterUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags);
55 | 
56 | NTSTATUS InstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects,
57 |                                _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags);
58 | 
59 | #endif /* MINIVERS_H */
60 | 


--------------------------------------------------------------------------------
/minivers/minivers.inf:
--------------------------------------------------------------------------------
 1 | ;;;
 2 | ;;; minivers
 3 | ;;;
 4 | 
 5 | [Version]
 6 | Signature   = "$Windows NT$"
 7 | Class       = "ActivityMonitor"                         ;This is determined by the work this filter driver does
 8 | ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}    ;This value is determined by the Class
 9 | Provider    = %ManufacturerName%
10 | DriverVer   = 05/28/2017,1.0.0.0
11 | CatalogFile = minivers.cat
12 | 
13 | [DestinationDirs]
14 | DefaultDestDir          = 12
15 | MiniFilter.DriverFiles  = 12            ;%windir%\system32\drivers
16 | 
17 | ;;
18 | ;; Default install sections
19 | ;;
20 | 
21 | [DefaultInstall]
22 | OptionDesc          = %ServiceDescription%
23 | CopyFiles           = MiniFilter.DriverFiles
24 | 
25 | [DefaultInstall.Services]
26 | AddService          = %ServiceName%,,MiniFilter.Service
27 | 
28 | ;;
29 | ;; Default uninstall sections
30 | ;;
31 | 
32 | [DefaultUninstall]
33 | DelFiles   = MiniFilter.DriverFiles
34 | 
35 | [DefaultUninstall.Services]
36 | DelService = %ServiceName%,0x200      ;Ensure service is stopped before deleting
37 | 
38 | ;
39 | ; Services Section
40 | ;
41 | 
42 | [MiniFilter.Service]
43 | DisplayName      = %ServiceName%
44 | Description      = %ServiceDescription%
45 | ServiceBinary    = %12%\%DriverName%.sys        ;%windir%\system32\drivers\
46 | Dependencies     = "FltMgr"
47 | ServiceType      = 2                            ;SERVICE_FILE_SYSTEM_DRIVER
48 | StartType        = 3                            ;SERVICE_DEMAND_START
49 | ErrorControl     = 1                            ;SERVICE_ERROR_NORMAL
50 | LoadOrderGroup   = "FSFilter Activity Monitor"
51 | AddReg           = MiniFilter.AddRegistry
52 | 
53 | ;
54 | ; Registry Modifications
55 | ;
56 | 
57 | [MiniFilter.AddRegistry]
58 | HKR,,"DebugFlags",0x00010001 ,0x0
59 | HKR,,"SupportedFeatures",0x00010001,0x3
60 | HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%
61 | HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%
62 | HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%
63 | 
64 | ;
65 | ; Copy Files
66 | ;
67 | 
68 | [MiniFilter.DriverFiles]
69 | %DriverName%.sys
70 | 
71 | [SourceDisksFiles]
72 | minivers.sys = 1,,
73 | 
74 | [SourceDisksNames]
75 | 1 = %DiskId1%,,,
76 | 
77 | ;;
78 | ;; String Section
79 | ;;
80 | 
81 | [Strings]
82 | ; TODO - Add your manufacturer
83 | ManufacturerName        = "Template"
84 | ServiceDescription      = "minivers Mini-Filter Driver"
85 | ServiceName             = "minivers"
86 | DriverName              = "minivers"
87 | DiskId1                 = "minivers Device Installation Disk"
88 | 
89 | ;Instances specific information.
90 | DefaultInstance         = "minivers Instance"
91 | Instance1.Name          = "minivers Instance"
92 | Instance1.Altitude      = "385100" ; minispy.sys - Top
93 | Instance1.Flags         = 0x0              ; Allow all attachments
94 | 


--------------------------------------------------------------------------------
/minivers/minivers.rc:
--------------------------------------------------------------------------------
 1 | #include <windows.h>
 2 | 
 3 | #include <ntverp.h>
 4 | 
 5 | #define VER_FILETYPE    VFT_DRV
 6 | #define VER_FILESUBTYPE VFT2_DRV_SYSTEM
 7 | #define VER_FILEDESCRIPTION_STR     "minivers Filter Driver"
 8 | #define VER_INTERNALNAME_STR        "minivers.sys"
 9 | 
10 | #include "common.ver"
11 | 


--------------------------------------------------------------------------------
/minivers/minivers.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Win8.1 Debug|Win32">
  5 |       <Configuration>Win8.1 Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Win8.1 Release|Win32">
  9 |       <Configuration>Win8.1 Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Win8 Debug|Win32">
 13 |       <Configuration>Win8 Debug</Configuration>
 14 |       <Platform>Win32</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Win8 Release|Win32">
 17 |       <Configuration>Win8 Release</Configuration>
 18 |       <Platform>Win32</Platform>
 19 |     </ProjectConfiguration>
 20 |     <ProjectConfiguration Include="Win7 Debug|Win32">
 21 |       <Configuration>Win7 Debug</Configuration>
 22 |       <Platform>Win32</Platform>
 23 |     </ProjectConfiguration>
 24 |     <ProjectConfiguration Include="Win7 Release|Win32">
 25 |       <Configuration>Win7 Release</Configuration>
 26 |       <Platform>Win32</Platform>
 27 |     </ProjectConfiguration>
 28 |     <ProjectConfiguration Include="Win8.1 Debug|x64">
 29 |       <Configuration>Win8.1 Debug</Configuration>
 30 |       <Platform>x64</Platform>
 31 |     </ProjectConfiguration>
 32 |     <ProjectConfiguration Include="Win8.1 Release|x64">
 33 |       <Configuration>Win8.1 Release</Configuration>
 34 |       <Platform>x64</Platform>
 35 |     </ProjectConfiguration>
 36 |     <ProjectConfiguration Include="Win8 Debug|x64">
 37 |       <Configuration>Win8 Debug</Configuration>
 38 |       <Platform>x64</Platform>
 39 |     </ProjectConfiguration>
 40 |     <ProjectConfiguration Include="Win8 Release|x64">
 41 |       <Configuration>Win8 Release</Configuration>
 42 |       <Platform>x64</Platform>
 43 |     </ProjectConfiguration>
 44 |     <ProjectConfiguration Include="Win7 Debug|x64">
 45 |       <Configuration>Win7 Debug</Configuration>
 46 |       <Platform>x64</Platform>
 47 |     </ProjectConfiguration>
 48 |     <ProjectConfiguration Include="Win7 Release|x64">
 49 |       <Configuration>Win7 Release</Configuration>
 50 |       <Platform>x64</Platform>
 51 |     </ProjectConfiguration>
 52 |   </ItemGroup>
 53 |   <ItemGroup>
 54 |     <ClCompile Include="RegistrationData.c" />
 55 |     <ResourceCompile Include="minivers.rc" />
 56 |     <ClCompile Include="copy_file.c" />
 57 |     <ClCompile Include="minivers.c" />
 58 |     <Inf Include="minivers.inf" />
 59 |   </ItemGroup>
 60 |   <PropertyGroup Label="Globals">
 61 |     <ProjectGuid>{E337AC23-F84D-4E6D-81E9-729F64684A30}</ProjectGuid>
 62 |     <TemplateGuid>{f2f62967-0815-4fd7-9b86-6eedcac766eb}</TemplateGuid>
 63 |     <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
 64 |     <MinimumVisualStudioVersion>11.0</MinimumVisualStudioVersion>
 65 |     <Configuration>Win8.1 Debug</Configuration>
 66 |     <Platform Condition="'$(Platform)' == ''">Win32</Platform>
 67 |     <RootNamespace>minivers</RootNamespace>
 68 |   </PropertyGroup>
 69 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 70 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|Win32'" Label="Configuration">
 71 |     <TargetVersion>WindowsV6.3</TargetVersion>
 72 |     <UseDebugLibraries>true</UseDebugLibraries>
 73 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 74 |     <ConfigurationType>Driver</ConfigurationType>
 75 |     <DriverType>WDM</DriverType>
 76 |   </PropertyGroup>
 77 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|Win32'" Label="Configuration">
 78 |     <TargetVersion>WindowsV6.3</TargetVersion>
 79 |     <UseDebugLibraries>false</UseDebugLibraries>
 80 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 81 |     <ConfigurationType>Driver</ConfigurationType>
 82 |     <DriverType>WDM</DriverType>
 83 |   </PropertyGroup>
 84 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|Win32'" Label="Configuration">
 85 |     <TargetVersion>Windows8</TargetVersion>
 86 |     <UseDebugLibraries>true</UseDebugLibraries>
 87 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 88 |     <ConfigurationType>Driver</ConfigurationType>
 89 |     <DriverType>WDM</DriverType>
 90 |   </PropertyGroup>
 91 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|Win32'" Label="Configuration">
 92 |     <TargetVersion>Windows8</TargetVersion>
 93 |     <UseDebugLibraries>false</UseDebugLibraries>
 94 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
 95 |     <ConfigurationType>Driver</ConfigurationType>
 96 |     <DriverType>WDM</DriverType>
 97 |   </PropertyGroup>
 98 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'" Label="Configuration">
 99 |     <TargetVersion>Windows7</TargetVersion>
100 |     <UseDebugLibraries>true</UseDebugLibraries>
101 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
102 |     <ConfigurationType>Driver</ConfigurationType>
103 |     <DriverType>WDM</DriverType>
104 |   </PropertyGroup>
105 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'" Label="Configuration">
106 |     <TargetVersion>Windows7</TargetVersion>
107 |     <UseDebugLibraries>false</UseDebugLibraries>
108 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
109 |     <ConfigurationType>Driver</ConfigurationType>
110 |     <DriverType>WDM</DriverType>
111 |   </PropertyGroup>
112 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|x64'" Label="Configuration">
113 |     <TargetVersion>WindowsV6.3</TargetVersion>
114 |     <UseDebugLibraries>true</UseDebugLibraries>
115 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
116 |     <ConfigurationType>Driver</ConfigurationType>
117 |     <DriverType>WDM</DriverType>
118 |   </PropertyGroup>
119 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|x64'" Label="Configuration">
120 |     <TargetVersion>WindowsV6.3</TargetVersion>
121 |     <UseDebugLibraries>false</UseDebugLibraries>
122 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
123 |     <ConfigurationType>Driver</ConfigurationType>
124 |     <DriverType>WDM</DriverType>
125 |   </PropertyGroup>
126 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|x64'" Label="Configuration">
127 |     <TargetVersion>Windows8</TargetVersion>
128 |     <UseDebugLibraries>true</UseDebugLibraries>
129 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
130 |     <ConfigurationType>Driver</ConfigurationType>
131 |     <DriverType>WDM</DriverType>
132 |   </PropertyGroup>
133 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|x64'" Label="Configuration">
134 |     <TargetVersion>Windows8</TargetVersion>
135 |     <UseDebugLibraries>false</UseDebugLibraries>
136 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
137 |     <ConfigurationType>Driver</ConfigurationType>
138 |     <DriverType>WDM</DriverType>
139 |   </PropertyGroup>
140 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'" Label="Configuration">
141 |     <TargetVersion>Windows7</TargetVersion>
142 |     <UseDebugLibraries>true</UseDebugLibraries>
143 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
144 |     <ConfigurationType>Driver</ConfigurationType>
145 |     <DriverType>WDM</DriverType>
146 |   </PropertyGroup>
147 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'" Label="Configuration">
148 |     <TargetVersion>Windows7</TargetVersion>
149 |     <UseDebugLibraries>false</UseDebugLibraries>
150 |     <PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
151 |     <ConfigurationType>Driver</ConfigurationType>
152 |     <DriverType>WDM</DriverType>
153 |   </PropertyGroup>
154 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
155 |   <ImportGroup Label="ExtensionSettings">
156 |   </ImportGroup>
157 |   <ImportGroup Label="PropertySheets">
158 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
159 |   </ImportGroup>
160 |   <PropertyGroup Label="UserMacros" />
161 |   <PropertyGroup />
162 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|Win32'">
163 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
164 |   </PropertyGroup>
165 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|Win32'">
166 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
167 |   </PropertyGroup>
168 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|Win32'">
169 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
170 |   </PropertyGroup>
171 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|Win32'">
172 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
173 |   </PropertyGroup>
174 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'">
175 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
176 |   </PropertyGroup>
177 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'">
178 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
179 |   </PropertyGroup>
180 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|x64'">
181 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
182 |   </PropertyGroup>
183 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|x64'">
184 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
185 |   </PropertyGroup>
186 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|x64'">
187 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
188 |   </PropertyGroup>
189 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|x64'">
190 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
191 |   </PropertyGroup>
192 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'">
193 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
194 |   </PropertyGroup>
195 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'">
196 |     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
197 |   </PropertyGroup>
198 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|Win32'">
199 |     <Link>
200 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
201 |     </Link>
202 |   </ItemDefinitionGroup>
203 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|Win32'">
204 |     <Link>
205 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
206 |     </Link>
207 |   </ItemDefinitionGroup>
208 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|Win32'">
209 |     <Link>
210 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
211 |     </Link>
212 |   </ItemDefinitionGroup>
213 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|Win32'">
214 |     <Link>
215 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
216 |     </Link>
217 |   </ItemDefinitionGroup>
218 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'">
219 |     <Link>
220 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
221 |     </Link>
222 |   </ItemDefinitionGroup>
223 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'">
224 |     <Link>
225 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
226 |     </Link>
227 |   </ItemDefinitionGroup>
228 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Debug|x64'">
229 |     <Link>
230 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
231 |     </Link>
232 |   </ItemDefinitionGroup>
233 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8.1 Release|x64'">
234 |     <Link>
235 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
236 |     </Link>
237 |   </ItemDefinitionGroup>
238 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Debug|x64'">
239 |     <Link>
240 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
241 |     </Link>
242 |   </ItemDefinitionGroup>
243 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win8 Release|x64'">
244 |     <Link>
245 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
246 |     </Link>
247 |   </ItemDefinitionGroup>
248 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'">
249 |     <Link>
250 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
251 |     </Link>
252 |   </ItemDefinitionGroup>
253 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'">
254 |     <Link>
255 |       <AdditionalDependencies>$(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
256 |     </Link>
257 |   </ItemDefinitionGroup>
258 |   <ItemGroup>
259 |     <FilesToPackage Include="$(TargetPath)" />
260 |     <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
261 |   </ItemGroup>
262 |   <ItemGroup>
263 |     <ClInclude Include="copy_file.h" />
264 |     <ClInclude Include="minivers.h" />
265 |   </ItemGroup>
266 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
267 |   <ImportGroup Label="ExtensionTargets">
268 |   </ImportGroup>
269 | </Project>


--------------------------------------------------------------------------------
/minivers/minivers.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |     <Filter Include="Driver Files">
17 |       <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
18 |       <Extensions>inf;inv;inx;mof;mc;</Extensions>
19 |     </Filter>
20 |   </ItemGroup>
21 |   <ItemGroup>
22 |     <Inf Include="minivers.inf">
23 |       <Filter>Driver Files</Filter>
24 |     </Inf>
25 |   </ItemGroup>
26 |   <ItemGroup>
27 |     <ClCompile Include="minivers.c">
28 |       <Filter>Source Files</Filter>
29 |     </ClCompile>
30 |     <ClCompile Include="copy_file.c">
31 |       <Filter>Source Files</Filter>
32 |     </ClCompile>
33 |     <ClCompile Include="RegistrationData.c">
34 |       <Filter>Source Files</Filter>
35 |     </ClCompile>
36 |   </ItemGroup>
37 |   <ItemGroup>
38 |     <ResourceCompile Include="minivers.rc">
39 |       <Filter>Resource Files</Filter>
40 |     </ResourceCompile>
41 |   </ItemGroup>
42 |   <ItemGroup>
43 |     <ClInclude Include="minivers.h">
44 |       <Filter>Header Files</Filter>
45 |     </ClInclude>
46 |     <ClInclude Include="copy_file.h">
47 |       <Filter>Header Files</Filter>
48 |     </ClInclude>
49 |   </ItemGroup>
50 | </Project>


--------------------------------------------------------------------------------