Something Wrong With Bdfsfltr

eaglenet

I have a driver that it is a filesystem filter driver.

Its fsd filter device above th bdfsfltr.

When IO MANAGER send IRP_MJ_CRRATE to the top of fsd device stack,my fsd filter device will call ZwCreateFile,cause a IRP_MJ_CREATE to lower device,reach to bdfsfltr. Then bdfsfltr will get the name of the file that send IRP_MJ_CREATE to the top of fsd device stack.

As you can see,Reentrant had happened.

Can you confirm the question?

rootkit

Hi

Sorry for the delayed reply.

I didn't understand your question.

Could you rephrase it? Also, please provide more details about the machine and operating system.

Thank you.