Windows filter driver that intercepts filesystem operations, registry operations and execution of processes
Budget: $750 – $1,500 USD
We need to be able to intercept all filesystem, registry and process operations, and be able to stop or modify the behaviour of the operation, or let it continue normally.
On one side we need a C/C++ Windows filter driver that can intercept all of these events, and then we need a C# library that connects to the driver somehow, maybe with P/Invoke but we are open to sugestions.
The C# library must be able to have events raised when a file is about to be read or modified (or other relevant operations like a process reading a file's information), and the methods that subscribe to such events, will be able to have all relevant information like, wich process is doing this, the path of the file being read or modified.
The subscribed methods should also be able to modify or stop the operation, for example, automatically encrypting/decrypting a file, or retrieving the file being asked from a remote server, or fully denying the operation.
Same idea for registry operations.
Regarding process executions, from C# we should be able to subscribe to an event that is raised when a new process is about to be executed, and get all information relevant like the path of the executable file and the arguments passed.
On the methods that subscribe to such events, we should be able to stop or modify the behaviour of the execution, for example, changing the file to execute or changing the arguments passed to it, or completly denying the execution.
Must work on Windows 7/8/10/11 and Windows Server 2012/2019/2022 both 32b (where available) and 64b.
C# library will be general purpose, no real logic must be implemented here, just be able to subscribe to relevant events and let a third party developer do whatever they need to.
If you have any questions please let me know. Thanks a lot in advance.
David
On one side we need a C/C++ Windows filter driver that can intercept all of these events, and then we need a C# library that connects to the driver somehow, maybe with P/Invoke but we are open to sugestions.
The C# library must be able to have events raised when a file is about to be read or modified (or other relevant operations like a process reading a file's information), and the methods that subscribe to such events, will be able to have all relevant information like, wich process is doing this, the path of the file being read or modified.
The subscribed methods should also be able to modify or stop the operation, for example, automatically encrypting/decrypting a file, or retrieving the file being asked from a remote server, or fully denying the operation.
Same idea for registry operations.
Regarding process executions, from C# we should be able to subscribe to an event that is raised when a new process is about to be executed, and get all information relevant like the path of the executable file and the arguments passed.
On the methods that subscribe to such events, we should be able to stop or modify the behaviour of the execution, for example, changing the file to execute or changing the arguments passed to it, or completly denying the execution.
Must work on Windows 7/8/10/11 and Windows Server 2012/2019/2022 both 32b (where available) and 64b.
C# library will be general purpose, no real logic must be implemented here, just be able to subscribe to relevant events and let a third party developer do whatever they need to.
If you have any questions please let me know. Thanks a lot in advance.
David