microsoft / microsoft/Windows-driver-samples
[filesys/miniFilter/avscan]: app maybe bypass scans via file mapping and subsequent memory writes.
Open
request
- Dominant language
- C
- Stars
- 7.8k
- Forks
- 5k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 7
Description
### Which is the area where the sample lives?
/filesys/miniFilter/avscan
### Describe the issue
The application performs file memory mapping, closes the opened file handle, and conducts write operations on the mapped memory area.Since the IRP_MJ_WRITE event is triggered after IRP_MJ_CLEANUP,scanning can be bypassed and relevant content may not be detected.Why not scan upon receiving the IRP_MJ_CLOSE notification also?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.