-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tracy Camp wrote: >> >> Probably nobody is really working with that because it's complicated >> for doing it alone and no serious team is still completed.If you have > > > I thought somebody (you?) had a start on a filter driver. I'd be happy > to start another one, but I've never contemplated writting a GPL'd > driver for NT before so would rather have an example to expand upon (I > presume we start with freeifs.h?). I've always just used the IFS kit ;)
Ahh...thats the problem.GPL one should not use IFS kit , and need one created from scratch. Besides IFS kit cost about 1000$ as I know :-( >> IFS basic driver I could help with integration clamav engine with it , >> however it looks like need rewrite because clamav is strictly file based >> not memory buffers (clamav is using a lot of temporary files) maybe it's >> possible to rewrite cl_gentemp function to use memory mapped files. > > >> IFS should postpone I/O operation during scan ,as I know it should be >> done by resubmitting IRP from completion routine - quite mystery for me >> because I'm working with device drivers only from time to time but not >> so frequently ;-D > > > Yes this is a very common technique in IFS drivers. The NT Insider has > quite a number of articals about various details of postponing IRPs. > > http://www.osronline.com/section.cfm?section=20 > > This is a free and very worthy publication BTW. > > t. Is this really free ? Regards Boguslaw Brandys -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDQWi9tuGICzHOh+YRAu8oAKCI8QM1ApCMwR0wgkj3C4ioqdin8QCdE3vS mkUaHql3Luq6KWf3UGaUGdI= =nUwb -----END PGP SIGNATURE----- _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
