Would implementing a Windows File System Minifilter Driver be appropriate in this case?

863 views Asked by At

I am looking for a better solution for the following situation:

We use a third party Windows application that reads a set of initialization files from a special location on disk when launched. Different settings are needed depending on the use-case and thus far we have accomplished that by copying the correct files into the settings folder using a script before launching the application. We run the application in a batch build system but its intended use is to be used interactively using its GUI. The settings files are fetched from a source code repository.

Copying files does not seem like a clean way to do this and I'd very much like to come up with a solution that allows me to redirect the application straight to the correct settings directory. Having read up on the subject I believe that a minifilter together with a user space application controlling which settings to use could most likely solve the problem.

Just to make myself clear, given the following directories:

(a) C:\Repos\Project1\Settings

(b) C:\Repos\Project2\Settings

(c) C:\Repos\Common\Settings

(d) C:\Program Files\Application\Settings

I want to hide the contents of (d) (if any) from one known application and replace it with a combination of the contents of ((a) and (c)) or ((b) and (c)). The way I propose to do this is through a redirecting File System Minifilter Driver and a user space application conveying information about what directories to handle.

* Is implementing a File System Minifilter Driver a viable solution in my case?

1

There are 1 answers

0
Ton Plooij On BEST ANSWER

Officially, a File System (Mini)filter Driver is the only possible way to do this. But beware that writing any kind of Windows driver has a steep learning curve. Have a look at the Microsoft SimRep FS filter driver example, which closely matches your use-case. If you have no previous Windows driver development experience I would not recommend taking this route.

A more viable solution would be to get into the application address space and intercept the CreateFile calls. You can then alter the file name, all in user-space code. Google for 'IAT hooking injection' to study this approach. Libraries exist to make this a fairly trivial task. For example, have a look at EasyHook.