Skip to content

Instantly share code, notes, and snippets.

@andronoob

andronoob/FsFilter1.sys

Last active July 18, 2018 06:58
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save andronoob/d5882c5e6d21f3dea534a68434abe040 to your computer and use it in GitHub Desktop.
Save andronoob/d5882c5e6d21f3dea534a68434abe040 to your computer and use it in GitHub Desktop.
Download ZIP
Stupid NTFS FSD Hook Driver
@adeelmunir
Copy link

Thanks for you response, I used FsFilter1.inf file, by right clicking inf file and install it after that used following command.
sc start FsFilter1
I am attaching two snapshots one for case with patchguard enable and other case by using Fyyre tool to disable patch guard.
fsfilter_patchguard_disabled
fsfilter_without_patchguard

  1. For patch guard disabled case, please check snapshot driver starts and shows some messages on cmd screen like service name, type and state etc, but I cant see any kernel debug messages on default dbgview, while the link you provided me is broken so I can download patched dbgview, so I am not sure what is happening using your driver code, not even sure about patchguard status.
  2. For patch gurad enable case, please check snapshot in this case driver service does not start and gives StartService failed 577: message related to digital signatures.

I only want to know about patchguard status using your driver code, please let know what to do further.

Thanks

@adeelmunir
Copy link

Hi Andronoob,

Can you tell me further for confirmation of your driver? I can't see it's working behavior

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment