Chapter 7: Filter Drivers

Overview

This chapter describes both file system filter drivers and network filter drivers. Filter drivers are used throughout the operating system to provide layered communications between high-level software and low-level hardware. Stacking, or layering, filters allows hardware and software interfaces to be connected using as many layers as necessary. This layered approach can be exploited to insert your own filters into existing stacks. Adding a layer to an existing stack can be extremely difficult to detect, yet allow full control over all communication passing through the stack. This can be especially useful when the stack controls a network interface card (NIC) or a disk drive.

This chapter includes the following:

• Filter driver insertion

• File system filter drivers

• Network filter drivers

• An example of both filtering techniques