EldoS | Feel safer!

Software components for data protection, secure storage and transfer

DeleteFilterRule does not seem to work

Also by EldoS: CallbackDisk
Create virtual disks backed by memory or custom location, expose disk images as disks and more.
#20652
Posted: 06/28/2012 05:27:21
by Jason Coleman (Basic support level)
Joined: 03/21/2012
Posts: 17

In the fileMon sample I do the following:
I create a rule as follows:
Code
mFilter.AddFilterCallbackRule(filename, Constants.chosenMonitoring);

Where Constants.chosenMonitoring is an OR of various events I want to intercept. Then, later...

Code
bool bRes = mFilter.DeleteFilterRule(filename, CbFltAccessFlags.ClearAccessFlags, Constants.chosenMonitoring);


The result in
Code
bRes = true
signifying success.

I then do the following:
Code
  
     int filterCount = mFilter.GetFilterCount();

     string filter;
     string EaName;
     CbFltAccessFlags accessFlags;
     CbFltCallbackFlags callbackflgs;
                              
     for (int i = 0; i < filterCount; i++)
     {
          if (mFilter.GetFilterRuleEx(i, out filter, out EaName, out accessFlags, out callbackflgs))
          {
          // And store the values in a file    
          }

     }


The
Code
getFilterRuleEx
contains the rule I thought I had deleted.

Any ideas?
#20653
Posted: 06/28/2012 05:37:31
by Jason Coleman (Basic support level)
Joined: 03/21/2012
Posts: 17

there's a mistake in the documentation on this page:

http://www.eldos.com/documentation/cbflt/ref_cl_cbflt_mtd_deletefilterrule.html.

The callbacks values appear to be wrong.
#20655
Posted: 06/28/2012 06:01:34
by Eugene Mayevski (EldoS Corp.)

Thank you for the pointer to documentation. This has been fixed in the latest build of CallbackFilter, which is available for download. Online version of the help file will be updated now as well.


Sincerely yours
Eugene Mayevski
#20657
Posted: 06/28/2012 06:36:36
by Eugene Mayevski (EldoS Corp.)

Help has been updated on the site. Please let us know if the problem persists with correct constants.


Sincerely yours
Eugene Mayevski
#20658
Posted: 06/28/2012 06:53:31
by Jason Coleman (Basic support level)
Joined: 03/21/2012
Posts: 17

Excellent support, quick reply :-)

I just tried the new download on a fresh XP install. I used the CBFilter_VS2010 example to install the driver. I restarted the machine, re-ran the example and started monitoring a directory.

I got a BSOD almost immediately. I have the kernel dump file and I note that the BSOD blames the CBFlt.sys file.

Regards,
J
#20659
Posted: 06/28/2012 06:57:16
by Eugene Mayevski (EldoS Corp.)

Moved to HelpDesk for investigation.


Sincerely yours
Eugene Mayevski
#20662
Posted: 06/28/2012 13:49:44
by Eugene Mayevski (EldoS Corp.)

BSOD fixed, the updated build is on the site.


Sincerely yours
Eugene Mayevski
Also by EldoS: CallbackProcess
A component to control process creation and termination in Windows and .NET applications.

Reply

Statistics

Topic viewed 1755 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!