Hello,
I am trying to create what I thought would be quite a simple file systme filter, based on the following assumption:
At some point during a readfile() routine, the filesystem HAS to call a readsector() routine (or equivilent).
My intention is, that when this request comes in I redirect it to a different sector on the disk.
Obviously I will be doing the same thing to the writefile/writesector routines when they come in, but I would like to start with read first.
The important thing, is that I catch this action, after it has been written to the NTFS equivilent of the File Allocation Table, so essentially, without my filter installed, the filesystem will look up the wrong sector for a file.
Is what I am trying to do even possible? I have already gotten the barbones of a device driver filter, I am catching the IRP_MJ_CREATE and _READ IRP's, and have managed to catch only certain filenames, so I know when the call to that file is coming in. Interestingly, when opening a 48byte file, I get three calls to IRP_MJ_CREATE, so possibly one of these three is the one.
Thanks