Skip to content

Kernel mode minifilter driver and User mode C# API for filesystem events monitoring

License

Notifications You must be signed in to change notification settings

kanitsharma/sniper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

17 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Sniper

Installing the kernel mode driver

The kernel driver needs to be compiled and installed manually. Therefore, make sure you have the Windows Driver Kit (WDK) 10 installed. After compiling the driver with VS, you can install the driver with the following command

 RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 ./sniper.inf

The driver will be loaded automatically after reboot. To load it manually without reboot, run

 fltmc.exe load sniper

If you don't have a valid code signing certificate and try to install the driver on 64bit Windows, you need to enable test signed drivers as described here.

Please make sure to always compile and install the correct driver version (32/64bit) depending on your operating system!

To uninstall the driver, run

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 132 ./sniper.inf

Usage

Check SniperTestApp for API Usage

WIP

  • Detect username responsible for I/O change.
  • Detect IP Address if change is done remotely.
  • Add Support for monitoring multiple paths.
  • Add package to nuget

About

Kernel mode minifilter driver and User mode C# API for filesystem events monitoring

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published