Minifilter newbie question

[navarromoral]

Hello everyone! I am new to minifilter drivers and I have thought to design one that just appends a non-existent file to a specified folder, that is, let's say for the folder \test\, when I open this folder with explorer I would like to see its content plus a non-existent file (whatever it's name is).

I know that I should intercept IRP_MJ_DIRECTORY_CONTROL, and append the FILE_BOTH_DIR_INFORMATION structure corresponding to the file I want to "add", but I don't know how to do this. One easy solution would be to create a IRP response with the mentioned structure in the pre-operation and let the minifilter drivers bellow mine do the rest, but I am not sure this is possible nor how to do this. (Another possibility would be to append this information in the post-operation)

Any help is appreciated, thanks in advance!!!

Santi

[coolo]

Hello Sir/Mam,
m a newbie in driver development
any way how do i start with building a file system filter driver to just capture all the IO packets
if u can frwd some links it ll b really helpful

Thank you