Probably nobody is really working with that because it's complicated for doing it alone and no serious team is still completed.If you have
I thought somebody (you?) had a start on a filter driver. I'd be happy to start another one, but I've never contemplated writting a GPL'd driver for NT before so would rather have an example to expand upon (I presume we start with freeifs.h?). I've always just used the IFS kit ;)
IFS basic driver I could help with integration clamav engine with it , however it looks like need rewrite because clamav is strictly file based not memory buffers (clamav is using a lot of temporary files) maybe it's possible to rewrite cl_gentemp function to use memory mapped files.
IFS should postpone I/O operation during scan ,as I know it should be done by resubmitting IRP from completion routine - quite mystery for me because I'm working with device drivers only from time to time but not so frequently ;-D
Yes this is a very common technique in IFS drivers. The NT Insider has quite a number of articals about various details of postponing IRPs.
http://www.osronline.com/section.cfm?section=20 This is a free and very worthy publication BTW. t.
P.S. I offer my little help if you are interested but please remember that I'm now inactive due to extensive work (job issues) Regards Boguslaw Brandys -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDQNm+tuGICzHOh+YRAi3KAJsFM/+R73ZQA+xK04/tUzi9LlOahgCeNH8s j+JBPDs3wGBkd5hdkIxOvP8= =BPxi -----END PGP SIGNATURE----- _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
_______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
