A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #31651  by nimaarek
 Tue Jun 12, 2018 10:01 pm
Hello,
I need to write a device driver that hooks up FileSystem activities. if the file was created or deleted, I would be informed by the driver.
The problem is that the driver should work in all versions of Windows! Is there anything possible?
Does the operating system architecture work effectively in writing the driver?
That is, have two separate drivers written for each architecture and windows version?
 #31673  by Vrtule
 Thu Jun 14, 2018 12:47 pm
Hello,
The problem is that the driver should work in all versions of Windows! Is there anything possible?
This is possible. A filesystem minifilter driver seems to be the right choice. They are supported starting Windows 200 SP4 (maybe some additional updates are required).
Does the operating system architecture work effectively in writing the driver?
Separate binaries for individual architectures (x86, x64, ARM, ARM64) are required. However, one driver may work on any Windows version (from 2000 up to latest Windows 10).