Latest fsredir in action

It's been a while since I last update this blog.

I want to tell that fsredir drivers almost complete (or already completes) and its now works on Windows XP too :) Of course it will works on windows 7 and windows PE. I haven't tested this driver with windows vista and other windows version because I don't have them but hope this driver works for them. Originally I want to make it support only for WinPE but considering that this driver might be helpful for some user such as lack of free space on C:\ drive and want to put the data on D:\ and still want windows to think that files still on C:\.



There is a person that work for F-Secure who helped me so much by giving me some tips and some tutorial links that helped me very much. Thanks to him, and with his help I can develop and debug fsredir driver easily. Here are some link that he shared with me and I want to share with you:

• http://virtualkd.sysprogs.org/ - VirtualKD, Windows kernel debugger booster for Virtual Machines. - I use Oracle VirtualBox with VirtualKD, debugging windows now become very fast as VirtualKD replace 10kb/s virtual COM Port to something faster.
• http://windbg.info/doc/2-windbg-a-z.html - WinDbg, From A-Z is everything you need to know about WinDbg. I didn't fully read this but it still helps me.
• http://www.docstoc.com/docs/38790050/Defeating-Kernel-Native-API-Hook - Become a clue how driver hooking works. Reminder: fsredir driver didn't use SSDT hooks or any hooking technique. It was only a minifilter driver based on SimRep and use callbacks.

Before, I debug my driver using minidump files created by BSOD as I don't know how to debug windows. Now with VirtualKd, it makes me want to learn basic Windows debugging  ;)

Latest fsredir driver now can copy directory content on... :S
Let's say you put fsredir.marker on D:\ and write \fsredir for root directory. You put files on D:\fsredir\test.txt, the files now appear on C:\test.txt

Here some picture fsredir in action running on Windows XP.

Creating a new file named as fsredir.marker on D:\

Put \fsredir inside fsredir.marker for root path

Creating a directory named fsredir as defined in the picture above for root

Putting some files on D:\fsredir

As you can see, test.txt now appears in C:\ too :) Double clicking it will opened notepad and read file contents originated from D:\fsredir\test.txt while notepad still thinks that file is on C:\test.txt

I will upload the driver later, so stay tuned :)