Main.c

#include "MainFunctions.h"

UNICODE_STRING dev;
UNICODE_STRING dos;

PDEVICE_OBJECT DeviceObject;

PFLT_FILTER Filter;

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(RegistryPath);

    NTSTATUS Status = FltRegisterFilter(DriverObject, &Registration, &Filter);

    DPrint("Register Filter: 0x%x\n", Status);

    if (NT_SUCCESS(Status))
        DPrint("Start filtering: 0x%x\n", FltStartFiltering(Filter));

    RtlInitUnicodeString(&dev, L"\\Device\\L3nAVFlt");
    RtlInitUnicodeString(&dos, L"\\DosDevice\\L3nAVFlt");

    IoCreateDevice(DriverObject, 0, &dev, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);

    IoCreateSymbolicLink(&dos, &dev);

    for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) {
        DriverObject->MajorFunction[i] = UnimplementedCall;
    }

    DriverObject->MajorFunction[IRP_MJ_CREATE] = CreateCall;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = CloseCall;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DevIOControl;

    DriverObject->Flags |= DO_BUFFERED_IO;

    return STATUS_SUCCESS;
}

NTSTATUS UnimplementedCall(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    UNREFERENCED_PARAMETER(DeviceObject);

    Irp->IoStatus.Information = 0;
    Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return STATUS_SUCCESS;
}

NTSTATUS CreateCall(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);

    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS CloseCall(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);

    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS DevIOControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);

    NTSTATUS Status = STATUS_NOT_SUPPORTED;
    ULONG BytesWritten = 0;

    //PIO_STACK_LOCATION IoStack = IoGetCurrentIrpStackLocation(Irp);

    // Code received from user space
    //ULONG ControlCode = IoStack->Parameters.DeviceIoControl.IoControlCode;

    // process according to the ctrlcode

    Irp->IoStatus.Status = Status;
    Irp->IoStatus.Information = BytesWritten;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return Status;
}

FLT_PREOP_CALLBACK_STATUS PreOpCallback(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
{
    UNREFERENCED_PARAMETER(CompletionContext);
    FLT_PREOP_CALLBACK_STATUS Status = FLT_PREOP_SUCCESS_WITH_CALLBACK;
    PFLT_FILE_NAME_INFORMATION FileNameInfo = NULL;

    DPrint("Yoooo\n");

    if (FltObjects->FileObject) {
        DPrint("GetFileNameInfo: 0x%x\n", FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP, &FileNameInfo));

        DPrint("ParseFileNameInfo: 0x%x\n", FltParseFileNameInformation(FileNameInfo));

        DPrint("Hum..\n");
    }
    else {
        DPrint("Ghosterino!\n");
    }

    return Status;
}