[R00tKit]

hi

i want write tool for monitor disk sector (MBR for write)
i know to stack of file system is some thing like

file system
class driver
port driver
bus driver

so where is best for install filter? port or bus ?( or hook specific function ? )

what port/bus driver( scasi, ATA ,IDE,pci,USB? ) make it more generic ?

[EP_X0FF]

MBR is dying.

Have a look on this trash http://www.blueridge.com/index.php/prod ... enterprise, I don't remember when I was looking for it, how exactly it "guards".

Actually you can prevent MBR writing by setting up just a few hooks in SSDT. Yep IOCTL's too. This is boring and what is the purpose?

[R00tKit]

just a few hooks in SSDT?

WriteFile and DeviceIoControl?

http://support.microsoft.com/kb/942448
documented way?

[EP_X0FF]

just a few hooks in SSDT?

WriteFile and DeviceIoControl?

http://support.microsoft.com/kb/942448
documented way?

Yes, maybe in general + NtCreateFile, for IOCTL's - SPTD, TDL4 was using this in it dropper for example. However this wont work on x64 due to obvious reasons. For those you can try writing minifilter driver (as example see ProcMon).