3 ms·
I'm pretty sure the latter (Win8 and on?) versions of Windows had some sort of framework for writing FS filter drivers or something, that the AVs are supposed t
by Joker_vD 4y ago
I'm pretty sure the latter (Win8 and on?) versions of Windows had some sort of framework for writing FS filter drivers or something, that the AVs are supposed to use?
- p_l 4y agoEvery NT version, in fact. Driver filters including filesystem filters are core NT feature. So you'd have to write a driver that hooked itself at appropriate step in IO Request processing, then it could inspect and gather data just like eBPF. Procmon uses diagnostic interfaces from outside kernel, might require debug permissions.