迷你过滤器无法阻止“Windows照片”打开的图像 [英] Mini-filter fails to block images opened by 'windows photos'

问题描述

我编写了一个迷你过滤器，可以阻止所有JPG图像相对成功。除非'Windows照片'正在打开文件。迷你过滤器已注册到所有MJ_CREATE，在WinDbg中，我可以看到我的代码在被Windows Photos打开时被调用以阻止JPG图像。但是，图像仍然可以成功加载。



测试环境：



图像在过滤器之前被复制已加载。安装过滤器然后系统重新启动。



问题：



图像仍可通过系统重启后的Windows照片。 （过滤器在启动时加载，因此技术上应该在重新启动后阻止图像。）



所有其他操作都被成功阻止，例如（复制，粘贴，打开另一个程序，如油漆）。尝试在启动后打开或转移的任何新JPG图像也会被成功阻止。



我尝试过：



PostOperatonCallback：

I've coded a mini-filter that blocks all JPG images with relative success. Except when the file is being opened by 'Windows Photos'. The mini-filter is registered to all MJ_CREATE's and in WinDbg I can see my code being called to block JPG images when being opened by Windows Photos. However, the image still loads successfully.

Testing Environment:

Images are copied over before the filter is loaded. The filter is installed then the system is rebooted.

Problem:

Images can still be accessed by Windows Photos after system reboot. (Filter is loaded on start-up so technically the images should be blocked after reboot).

All other operations are blocked successfully, e.g. (Copy,Paste, Opening with another program like paint). Any new JPG images attempting to be opened or transferred after boot are blocked successfully as well.

What I have tried:

PostOperatonCallback:

if (RtlCompareUnicodeString(&fileDetails->Extension, &jpgExt, TRUE) == 0)
{

    DbgPrint("Blocking JPG file...\n");
    FltCancelFileOpen(FltObjects->Instance, FltObjects->FileObject);

    Data->IoStatus.Status = STATUS_ACCESS_DENIED;
    Data->IoStatus.Information = 0;

    FltReleaseFileNameInformation(fileDetails);

    return FLT_POSTOP_FINISHED_PROCESSING;
}

过滤器启动参数：

Filter Startup parameters:

StartType = 0
Class = "ActivityMonitor"
Altitude= "370030"

我'我想知道我错过了什么？是否有一些图像被装载得太早以至于它绕过了FilterManager？是否有IRP我可能会失踪？我现在的目标是阻止所有JPG被加载（如果可能的话包括缩略图）。



非常感谢每个花时间的人阅读我的问题和任何可以提供帮助的人。



干杯，



布莱斯伍兹

I'm wondering what I am missing? Are some images being loaded so early that it bypasses the FilterManager? Is there an IRP I may be missing? My end goal for now is just to block all JPG's from being loaded (if possible including the thumbnail).

A massive thank-you to everyone who has taken the time to read my question and to anyone who can help.

Cheers,

Bryce Woods

推荐答案

您的过滤器运行良好。但是照片应用程序正在使用它自己的缓存来加载图像，即使源不再存在（或者访问被过滤器阻止）。

Your filter is working well. But the photo application is using it's own cache from where images are loaded even when the source does not exist anymore (or access is blocked by your filter).

这篇关于迷你过滤器无法阻止“Windows照片”打开的图像的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！