compare a directory name with another

julien

Hello,

I catch every I/O on the filesystem, for IRP_MJ_CREATE for example, I
display :
IRP : [IRP_MJ_WRITE] FILE : [\WINDOWS\system32\config\][system.LOG]
IRP : [IRP_MJ_CREATE] FILE : [\Documents and Settings\All Users\Application
Data\VMware\][VMware Tools]
.... (same for lot of files)

I'd like to only display IRP which match with a directory I've defined, like
Desktop for example.

Is it possible, and how ?

julien

Hi,

Sorry if question was badly asked, i don't fluently speak english.

I'd like to identify a file, more precisely a directory, on a other name
that by its name, in the PFLT_PRE_OPERATION_CALLBACK

Does anyone knows if it is possible ?



"julien" wrote:

> Hello,
>
> I catch every I/O on the filesystem, for IRP_MJ_CREATE for example, I
> display :
> IRP : [IRP_MJ_WRITE] FILE : [\WINDOWS\system32\config\][system.LOG]
> IRP : [IRP_MJ_CREATE] FILE : [\Documents and Settings\All Users\Application
> Data\VMware\][VMware Tools]
> ... (same for lot of files)
>
> I'd like to only display IRP which match with a directory I've defined, like
> Desktop for example.
>
> Is it possible, and how ?
>