Repository navigation
[filesys/miniFilter/avscan]: app maybe bypass scans via file mapping and subsequent memory writes. #1371
Description
Activity
@microsoft/filter-manager Christian Allred (@cgallred)
It seems that implementing a scan upon receiving the
IRP_MJ_CLOSEnotification could help ensure that any relevant data written to the memory-mapped area is still subjected to scanning. Have you considered how the potential overhead of this additional scan might impact performance, especially in high-frequency file operations?Because the file handle is closed before the writes to the mapped memory the IRP_MJ_WRITE comes after IRP_MJ_CLEANUP and gets bypassed. We could track memory mapping in the create path and only scan on close for those files to limit the overhead when many handles close at once.
Which is the area where the sample lives?
/filesys/miniFilter/avscan
Describe the issue
The application performs file memory mapping, closes the opened file handle, and conducts write operations on the mapped memory area.Since the IRP_MJ_WRITE event is triggered after IRP_MJ_CLEANUP,scanning can be bypassed and relevant content may not be detected.Why not scan upon receiving the IRP_MJ_CLOSE notification also?