difi

KO | EN

gitlite — search

#javascript #react #typescript #docker #java #nodejs #windows #awesome #cli #awesome-list #vue #security #mcp #openai

(★ 44)

Windows disk filter driver to demonstrate sector write redirection

difi Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Difi
====

Difi is a disk filter driver (in Windows DDK terminology) which can redirect disk sector writes to a "hidden" area on disk and consequently return these sectors back for reads. Difi was written as proof of concenpt for bigger virtualization research project.

Design overview
===============

Difi is an upper disk filter driver, it intercepts both reads and writes. If activated, Difi redirects writes to a pre-allocated space on disk, and creates a map of redirected sectors.

How disk space is allocated
---------------------------

Disk space should be allocated in advance using difi-cli utility, which simply creates hidden/system file on disk, obtains its extents (big thanks to Mark Roddy for filterExtents source code!) and sends the information to the driver. Not very smart approach, but it was good enough for the prototype.

How sector mappings are stored
-------------------------------

The disk remapper works with extents. An extent is represented by an inteval of a starting sector and a length. When a write is intercepted, Difi looks in the list of free extents for free one, and creates a mapping. Originally I was going 
to use interval tree, but abandoned the idea after playing around with prototype as too complex and not very suitable for real time environment. Instead, Difi uses simple hash map where I store sector-to-sector mapping. It's probably less memory efficient, but very simple, fast, and can be easily optimized if required.

Code overview
=============

- Modular kernel mode driver: code split into main driver and several static
  libraries. Libraries are portable, and are used in both driver and user mode unit test 
- Unit tests for C code base using CUtest
- Linux-kernel coding style in Windows

How to build
==============================================================

To compile all projects, you need:
- Microsoft Windows DDK 7.1
- Microsoft Visual C++ Express 2010 or above

To build kernel mode components, first start "x86 checked mode environment" command
prompt and run build.bat in it.

How to run
==============================================================

DO NOT RUN DIFI ON YOUR PHYSICAL COMPUTER, USE A VIRTUAL MACHINE!

Difi is destructive by nature, and I would hate it if you ruin your hard drive. So if you're really want to give it a test drive, use a virtual machine. You'll also have to turn driver sign verification off.

To install and run Difi drivers, you'll need several command line utilities:

addfilter.exe
psshutdown.exe

Run support/deploy.bat to deploy all Difi components to the target computer. Then run instdififilt.bat there, it will copy the driver to windows system directory and reboot. After reboot, the driver is ready to use.

(more is coming)

difi

difi Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

difi

difi Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README