CBFS Filter 2024 Changelog

This document provides high-level information about new features, fixes, and functionality changes between minor versions releases of CBFS Filter. The information provided here is also available as an RSS feed.

For more details or if you have any questions please contact support@callback.com

[NEW] (Rust) The dynamic library is now loaded only when a trait instance is created.

Version: 24.0.9316
Date: July 4, 2025

[IMPORTANT] [CBMonitor, CBFilter] In AfterGetFileSecurity and NotifyGetFileSecurity events, the semantics of the Length and LengthNeeded parameters has changed. The LengthNeeded parameter has been renamed to DescriptorLength to reflect the nature of the value.
[NEW] [CBMonitor, CBFilter] Added the INSTALL_SKIP_PREPARING_FILES_WITH_NO_RULES installation flag and the corresponding SkipPreparingFilesWithNoRules configuration setting.
[NEW] [CBMonitor, CBFilter] Added the DelayTimeoutStart configuration setting.
[FIX] Filter rules with an inverted PID mask (~PID|filtered_path) were interpreted in the kernel parser as rules with a process name mask.
[FIX] [CBMonitor, CBFilter] On Windows 2016 Server and Windows 2012 R2 Server, a crash could occur when using the CollectRemoteOpenInformation setting due to the misleading information provided by the OS (the version number suggests a certain format of the data, while the data have different format). Windows 2019 Server provides the correct version number, and the problem doesn't exist in newer OS versions.
[FIX] [CBMonitor, CBFilter] Improved caching of network resource paths for the purpose of correct back-resolving of NT-native paths of network files to their local/mapped paths.
[FIX] [CBFilter] In some cases, a crash could occur when the PassSecurityInFileOpenEvents setting was set and no security information was available during file opening.
[FIX] [CBFilter] If a MMF could not be opened in the CreateFileDirect when requested, a handle to a file was returned instead of an error.
[FIX] [CBFilter] An MMF could not be opened from the BeforeWriteFile event.
[FIX] [CBFilter] If a file was opened asynchronously and isolation-by-redirection was used, the backend file was also opened asynchronously, which could cause problems with NTFS.

Version: 24.0.9218
Date: March 28, 2025

[IMPORTANT] [CBFilter] The SendViaStack parameter of CreateFileDirect and CreateFileDirectAsStream methods has been replaced with DirectFlags, which is a combination of different parameters that control the handling of the operation.
[NEW] [CBFilter] Now, CreateFileDirect and CreateFileDirectAsStream are able to re-use an existing file object and to create a memory mapping to a file (see the description of the corresponding methods and the flags in the DirectFlags parameter for details).
[NEW] [CBFilter] Added the OmitDataInReadWriteEvents configuration setting (see the description in the help file for details)
[NEW] [CBFilter] Added the AdjustDataSizeOnWrite configuration setting (see the description in the help file for details)
[NEW] [CBFilter] Added the CaptureTokenForNotifyEvents configuration setting to enable the use of the GetOriginatorToken method in Notify* events.
[NEW] [CBFilter] Added the EnableIsolationSupport configuration setting (enabled by default) to let applications enable or disable isolation support - its disabling saves a few CPU ticks when handling certain requests if filtering is active.
[FIX] [CBFilter] Using AddFilterRuleEx or AddPassthroughRuleEx methods could leave a file handle, potentially preventing file deletion and causing a resource leak (a regression in build 9140).
[FIX] [CBFilter] If the Synchronize parameter of the CreateFileDirect or CreateFileDirectAsStream method was set to true, the value of the SendViaStack parameter was ignored and the request was sent via the stack.
[FIX] [CBFilter] Reading the altitude from the component when using several instances of the component in one process returned the same altitude for all instances.
[FIX] [CBFilter] An occasional memory corruption could happen on some systems in unidentified circumstances.
[FIX] [CBFilter] CreateFileDirect could crash on 32-bit systems.
[FIX] [CBFilter] CreateFileDirect was not always working with custom filesystems based on Dokan(y). A workaround has been added.

Version: 24.0.9140
Date: January 9, 2025

[IMPORTANT] [CBMonitor, CBFilter] The code that determines the value for the Direction parameters of *ReadFile and *WriteFile events has been refactored. Specifically, Direction is more frequently set to SYSTEM_NONCACHED than before. If your event handlers deal with both cached and non-cached requests, it is necessary to revisit the implementation and ensure that it works as expected.
[IMPORTANT] [CBFilter] Previously, a call to CreateFileDirect for a file that resides on a network share, if DesiredAccess specified reading and writing and the original attempt failed, could open a file in read-only mode. In earlier versions of Windows such a handle was suitable for writing and deletion, but on Windows 10/11, it is not possible to modify or delete the file using such a handle. As of this version CreateFileDirect does only what was requested and does not open a file in read-only mode. A caller can do this if necessary.
[IMPORTANT] [CBFilter] If a file is isolated, all further concurrently opened handles to it will have a unique FileContext holder for each handle (i.e., FileContext will behave similar to HandleContext) until all handles to this file are closed.
[FIX] [CBFilter] The Direction parameter was not correct for network drives when a file was isolated.
[FIX] [CBFilter] In extended rules, the MinSize and MaxSize parameters could be ignored (a regression made in recent builds).
[FIX] [CBFilter] A wrong (earlier) name could be passed to events after a file was renamed.
[FIX] [CBFilter] File contexts could leak when a file was isolated, leading to the impossibility to re-open the file.
[FIX] [CBFilter] A request to query volume information made over an isolated file that "resides" on a network volume failed. Now, an attempt is made to use a backend file (if one is present) or a parent directory of the isolated file to obtain this volume information.
[FIX] [CBMonitor, CBFilter] When a removable device was added or deleted, depending on the exact NT-native names of other devices, an internal error could happen leading to the deactivation of the component.
[FIX] [CBMonitor, CBFilter] A read-only access rule didn't prevent creation of a subdirectory (the OS does not open a directory when creating a subdirectory in it).
[FIX] [CBMonitor, CBFilter] Memory corruption could occur in Windows 11.

Version: 24.0.9075
Date: November 5, 2024

[IMPORTANT] [CBFilter] *SetFileInformation events are not fired when the cache manager sends file expansion requests, as these requests don't really affect file size.
[NEW] [CBFilter] The CreateFileDirect method now accepts supplementary flags that instruct it to open only a directory or only a file (the operation would fail if the existing entry doesn't match the required type).
[NEW] [CBFilter] Added the SetFileSizeOnWrite configuration setting.
[NEW] [CBFilter] Added the IgnoreOldNamesInRuleMatching configuration setting.
[NEW] [CBFilter] Added the CheckFileAccessInDirectIO configuration setting.
[NEW] [CBFilter] Added the DenyExpiredRequests configuration setting.
[FIX] [CBFilter] If a file was opened concurrently as isolated and not isolated, the user contexts set by the application could be misused by passing them to other event handlers.
[FIX] [CBMonitor, CBFilter] A delay could occur when starting a filter with a larger number of slow network drives in the system (e.g., those mounted over VPN).
[FIX] [CBRegistry] Fixed the handling of access rules.

Version: 24.0.9035
Date: September 26, 2024

[IMPORTANT] (Rust) Updated the API to make it more conformant to Rust rules.
[IMPORTANT] [CBFilter] The stream, returned by CreateFileDirectAsStream, didn't update the internal position variable after read/write/seek operations. This has been fixed, so now, no additional seeking is required.
[FIX] [CBFilter] The value of EventContext set in the OnReparseFileName event handler didn't get to OnBeforeCreateFile/OnBeforeAdfterFile/OnAfterCreateFile/OnAfterOpenFile handlers.
[FIX] [CBMonitor, CBFilter] name handling in the rules library could fail on some specific names (border cases discovered).
[FIX] A memory leak could occur in non-Unicode editions (Go, Rust, ANSI-based C++) when events were fired.

Version: 24.0.9000
Date: August 22, 2024

[FIX] [CBFilter] For isolated files with no backend, the driver could report that no such file existed after the file was closed.
[FIX] [CBFilter] In the CreateFileDirect and CreateFileDirectAsStream methods, a zero value of the FlagsAndAttributes parameter is accepted now.

Version: 24.0.8990
Date: August 12, 2024

[FIX] On Windows 7, the installer now installs the drivers signed by Microsoft using SHA-256. Some Windows 7 systems support SHA256 signatures, others don't.

Version: 24.0.8974
Date: July 27, 2024

[NEW] Initial release of version 2024

Version: 22.0.8943 Date: June 26, 2024

[FIX] [CBFilter] The active filter could prevent a Rename/Move operation in the system from completion, when the operation was performed with POSIX symantics.
[FIX] [CBFilter] In Windows 7 64-bit, resolving the path that includes a reparse point causes a null pointer error in Windows API due to insufficient checks in it. A workaround has been added.
[FIX] [CBFilter] When the AddBytesToWriteBuffer method was used, writing of filtered data could fail in some cases (exposed by the AddHeader sample).
[FIX] [CBFilter] A rare race condition in the driver was addressed.

Version: 22.0.8803 Date: February 7, 2024

[FIX] [CBFilter] When a rule for BeforeFsctl or AfterFsctl was set, reparse point operations on filtered filesystem entries could fail.
[FIX] [CBFilter] CreateFileDirectwith Synchronize parameter set to false ignored the value of the DirectRequestsDownTheStack configuration setting and sent requests directly to the filesystem.
[FIX] [CBFilter] The DirectRequestsDownTheStack functionality was improved to direct requests down the minifilter stack (earlier, they were directed down the legacy filter stack).

Version: 22.0.8678
Date: October 5, 2023

[IMPORTANT] [CBMonitor, CBFilter] The driver now remembers all file names while the file is opened. This means that after a file is moved/renamed or a hardlink is created, all known names are matched against both filter rules and passthrough rules. Complete closing of a file clears the list of known names, so after the file is reopened, old names and possible hard links are not known.
[NEW] [CBMonitor, CBFilter] When the SerializeAccess configuration setting was true, the AfterCreateFile/AfterOpenFile events still were exclusive.
[FIX] The drivers could not be installed on Windows 2012 R2 Server due to the problems with signature validation (the OS doesn't accept Microsoft's own SHA2 signature). The INSTALL_FORCE_SHA1_DRIVERS flag was added to address this problem.
[FIX] [CBMonitor, CBFilter] Various stability improvements.

Version: 22.0.8591
Date: July 10, 2023

[FIX] [CBFilter] File and Handle contexts could be lost in AfterCreateFile/AfterOpenFile when they were set in BeforeCreateFile/BeforeOpenFile.
[FIX] [CBFilter] If ModifiableReadWriteBuffers config setting was set to false (default) and AddBytesToWriteBuffer was called, a filesystem driver could overwrite the passed buffer. Now, both this issue is fixed and the AddBytesToWriteBuffer sets ModifiableReadWriteBuffers to true.

Version: 22.0.8573
Date: June 22, 2023

[NEW] [CBFilter] Now, the CreateFileDirect method can open files with UNC paths.
[FIX] The driver could not be loaded (crashed) on Windows 11 for ARM.
[FIX] [CBFilter] Deletion could not be silently denied by simply setting ProcessRequest to false in BeforeCanFileBeDeleted.

Version: 22.0.8558
Date: June 7, 2023

[NEW] [CBMonitor, CBFilter] Now, the CreateFileDirect method can use the DesiredAccess, CreationDisposition, and FlagsAndAttributes parameters when the Synchronize parameter is true.
[NEW] [CBMonitor, CBFilter] When StopFilter is called, the component now waits until all pending callbacks come from the kernel and fires the appropriate events.
[NEW] [CBFilter] Handles, created using the CreateFileDirect method, can now be used in calls to the BackupRead Windows API function.
[NEW] [CBFilter] Added the SerializeAccess configuration setting.
[FIX] [CBMonitor, CBFilter] When filtering was started using StartFilter, user-mode callbacks could be called before the initialization was complete, and this could lead to an internal error.
[FIX] [CBMonitor, CBFilter] An Invalid Parameter error could occur when CreateFileDirect was used and there was an RDP/Terminal Services session active and the application was run with limited rights.

Version: 22.0.8485
Date: March 26, 2023

[FIX] Improved the installation procedure in situations where the driver is busy and cannot be updated immediately during the Install() call.
[FIX] A component could block on a StopFilter call.
[FIX] [CBFilter] invalid memory access in the ReparseFileName callback function that occurred when a new file name was set.
[FIX] [CBMonitor, CBFilter] Added a workaround to some Windows glitch, where a drive's DOS device name resolved by Windows was not then usable in other Windows calls. This could lead to impossibility to use a filter rule which was specific to that drive.
[FIX] [CBFilter] [.NET, Java, Python] When the ReparseWithTag event was enabled with a rule and a symlink was accessed (e.g., a directory symlink), the Invalid Memory Access error happened.
[FIX] [CBFilter] The SetFileInformationDirect method could fail with the AccessViolation error in the kernel and didn't report this error back.
[FIX] [CBFilter] Improved operation of the AddBytesToWriteBuffer method.

Version: 22.0.8465
Date: March 6, 2023

[IMPORTANT] [CBMonitor, CBFilter] The StopFilter method is synchronous now - the WaitForDetach parameter has been made obsolete and its value is ignored.
[NEW] [CBMonitor, CBFilter] The Altitude property had to be set after a call to Initialize. Now, this is not required as Initialize reads the value from the registry.
[FIX] An Access Violation error could happen when a filter is stopped (v2022 regression).
[FIX] [CBProcess] Specifying just thread operations to be captured didn't work right (wrong events were fired).

Version: 22.0.8441
Date: February 10, 2023

[FIX] If an error occured in one of the methods, in some cases, it was not reported via OnError, and an exception (where applicable) didn't contain an error message.
[FIX] [CBFilter] The AfterLock event passed request parameters incorrectly.
[FIX] [CBFilter] CreateFileDirect could fail to work when the process didn't have sufficient rights.

Version: 22.0.8425
Date: January 25, 2023

[IMPORTANT] [CBProcess] The EventsToFire configuration setting now determines, which events are fired. Its default value is 0, meaning that no events are fired. An application needs to update the setting's value in order to receive events.
[FIX] [CBFilter] Fixed reporting of an internal error from the ReparseWithTag and ReparseFileName events
[FIX] [CBProcess] The INSTALL_REMOVE_OLD_VERSIONS and UNINSTALL_VERSION_PREVIOUS flags did not work during installation/deinstallation of the driver.

Version: 22.0.8400
Date: December 31, 2022

[NEW] Initial release of version 2022
[IMPORTANT] The Altitude property is a string now, which better conforms to Microsoft altitude assignment rules.
[IMPORTANT] The Initialize method will fail with an error if the kernel-mode driver is not installed OR if the version of the driver is lower than the version of the user-mode library.
[IMPORTANT] Mask matching in rules has been extended to support inverted rules.
[IMPORTANT] [CBMonitor] If an application configures the rule(s) so that both the ACCESS_READ_ONLY access flag and any callback/notify flags are in effect during the same file open operation, the ACCESS_READ_ONLY access flag will not be taken into account. The application can deny file opening or modify the way the file is accessed from the BeforeOpenFile event handler.
[IMPORTANT] [CBMonitor] If the ResolveNtDeviceToDriveLetter configuration setting is true, enumeration of default and reparse rules as well as the GetReparseRuleByMask method try to resolve the path in the mask back to DOS device name.
[IMPORTANT] [CBMonitor] The values of the FS_CE_REPARSE_FILENAME and FS_CE_REPARSE_TAG constants have been changed. If an application uses numeric values and not constants, those values need to be updated.
[IMPORTANT] [CBFilter] The {Before|After}CreateFile and {Before|After}OpenFile events got new parameters, reserved for future use.
[NEW] [CBMonitor] One can specify the mask that excludes Alternate Data Streams
[NEW] [CBMonitor] New events, related to reparse point operations (*{Get|Set}ReparsePoint).
[NEW] [CBMonitor] New events, related to operations with extended attributes (*{Query|Set}Ea).
[NEW] [CBMonitor] Added the Flags and Index parameters to AfterEnumerateDirectory and NotifyEnumerateDirectory events
[NEW] [CBMonitor] The GetDOSPathName and GetNTPathName helper methods has been added.
[NEW] [CBMonitor] The \*CanFileBeDeleted and \*DeleteFile events got the RequestType parameter
[NEW] [CBFilter] Added the BeforeEnumerateDirectory event
[NEW] [CBFilter] Added the FileContext and HandleContext parameters to the BeforeCreateFile and BeforeOpenFile events
[NEW] [CBFilter] Added the FileContext and HandleContext parameters to the CloseEnumeration event
[NEW] [CBFilter] The ReparseWithTag event got the NewFileName parameter
[NEW] [CBRegistry] The ForceAppPermissionCheck and ForceSecurityChecks configuration settings have been added
[NEW] [CBRegistry] The \*{Get|Set}KeySecurity events have been added.

Version: 20.0.8404
Date: January 4, 2023

[IMPORTANT] [CBProcess] The EventsToFire configuration setting now determines, which events are fired. Its default value is set to fire all events, however, for performance reasons, it is recommended that an application updates the setting's value in order to receive only the needed events.
[FIX] [CBFilter] Fixed reporting of an internal error from the ReparseWithTag and ReparseFileName events

Version: 20.0.8351
Date: November 12, 2022

[FIX] An attempt to operate with rules while the filter was not initialized returned a confusing error code 3 in some situations. Now, a more meaningul ERROR_NOT_READY error is returned.
[FIX] Various stability improvements.

Version: 20.0.8317
Date: October 9, 2022

[FIX] [CBRegistry] In the PreCreateOpenKeyEx event, the key opening status was overriden in some cases.
[FIX] [CBFilter] If both AfterSetFileInfo and AfterRenameOrMoveFile events were enabled, the ProcessFailedRequests property was set to true, and an error occured, AfterSetFileInfo was fired and AfterRenameOrMoveFile was lost.

Version: 20.0.8124
Date: March 30, 2022

[FIX] BSOD could occur in rare cases if the user-mode application was terminated.
[FIX] When a passthrough rule was added in addition to filter rules, events could occasionally fire or access could be blocked for seemingly unrelated files and operations.
[FIX] Driver Verifier reported allocation of memory in non-paged pool without Nx flag. Workardound added.

Version: 20.0.8069
Date: February 3, 2022

[NEW] Added support for x64 operations on Windows 11/ARM64 systems. Now, the installation methods executed in x64 mode can install the drivers and the helper DLL to such as system.
[FIX] If a legacy filter driver was present in the filter stack, the CBFilter driver could block the renaming operation with the "NOT SAME DEVICE" error.
[FIX] If the FlushOnClose parameter was set, the cache flush procedure would reset its size to zero, which would also change the SharedCacheMap size in other processes (threads) that accessed the file simultaneously. As a result, the file could be corrupted.
[FIX] In the case when the low-level filter returned STATUS_REPARSE, The CBFilter driver treated it as a successful open operation and sent another request to the filesystem. This caused a conflict with a third-party driver resulting in a crash.

Version: 20.0.8047
Date: January 12, 2022

[FIX] [CBFilter] Improved handling of rename operations when they are performed over reparse points or to a different drive.
[FIX] [CBFilter] In rare cases, in the AfterRenameOrMoveFile event, both old and new names could be the same (equal to the new name).
[FIX] Improved the way rules are stored in the tree to avoid desynchronization of rules between the kernel and the user mode in complex dynamic scenarios.

Version: 20.0.8008
Date: December 4, 2021

[NEW] Rule masks may contain the \\?\ prefix. This is the most useful for VolumeGUID-based masks.

Version: 20.0.7982
Date: November 8, 2021

[FIX] A sporadic C++ exception could happen upon deletion of the component or application shutdown due to a compiler quirk.

Version: 20.0.7979
Date: November 5, 2021

[NEW] Process tracking library improved, so the loaded driver should cause a slightly lower effect on system operations.
[FIX] [CBFilter] When the volume was re-mounted by the OS with handles on it not being closed beforehand, the driver didn't have a chance to dispose of already invalid information about the volume, so a subsequent access to the volume's files using CreateFileDirect could fail. A workaround for this unexpected OS behavior has been added.
[FIX] [CBFilter] A crash could happen in Windows Server when a specific network request was made to a monitored disk.

Version: 20.0.7905
Date: August 23, 2021

[NEW] nodeJS edition (Beta).

Version: 20.0.7836
Date: June 15, 2021

[NEW] Added an option to add and delete default rules without requiring administrative permissions. To prevent misuse of this option, the ForceAdminRightsForDefaultRules config setting has been added.
[FIX] When CBFilter and CBRegistry worked in parallel, they competed for RuleSet IDs, leading to one of the components not firing events.
[FIX] [.NET Standard] Removed various attribute class types that are already present in .NET Standard core assemblies.
[NEW] [CBFilter]: Improved the speed of operations of calling the user mode for firing of events.
[NEW] [CBFilter]: Improved the speed of operations with file names when a file is opened or when an event fires.
[FIX] [CBFilter]: In some cases, On\*Fsctl events were skipped.
[FIX] [CBFilter]: Masks that include an absolute path but no drive name (letter or GUID) didn't work.
[FIX] [CBFilter]: Redirection to another volume using the OnReparseFileName event didn't work in some cases.
[FIX] [CBFilter]: An internal/unhandled error that occurred during handling of file opening could lead to blocking of the file open operation.
[FIX] [CBFilter]: Execution of the OnWorkerThreadTermination event handler was not fully completed before the component was destroyed, which could lead to an Access Violation upon shutdown.
[FIX] [CBFilter]: The AddHeader method in Legacy mode failed with assertion.
[FIX] [CBRegistry]: Default rules didn't work in some cases.
[FIX] [CBFilter]: Regression: Events, related to new volumes being added and removed from the system, were not fired.
[FIX] [CBFilter]: Regression: Hiding an entry in OnAfterEnumerateDirectory could randomly cause a crash.
[FIX] [CBProcess]: Error was not reported properly by StartFilter.

Version: 20.0.7663
Date: December 24, 2020

[FIX] Regression: When the filter was stopped and restarted, rules were lost.
[FIX] [CBRegistry]: The component did not work on Windows Vista.

Version: 20.0.7656
Date: December 17, 2020

[FIX] [CBFilter]: Access to some rule-related methods could cause the component to be blocked on StopFilter.
[FIX] [CBFilter]: CanDelete parameter was always true in OnAfterCanFileBeDeleted and OnNotifyCanFileBeDeleted events.
[FIX] [CBProcess]: The component did not work on Windows Vista.

Version: 20.0.7647
Date: December 8, 2020

[NEW] Global performance optimizations in rule handling.
[NEW] [CBFilter]: Minor performance optimization in GetOriginatorProcessName.
[FIX] Kernel-mode logging didn't work when enabled via the registry.
[FIX] In certain rare combinations of rule settings which included the same path, only the first rule was taken into account.

Version: 20.0.7543
Date: August 26, 2020

[IMPORTANT] [CBFilter]: The reparse buffer pointer in the OnReparseWithTag event previously pointed to the data block after the fixed header (which was different from the documentation). Now, it points to the beginning of the structure.
[IMPORTANT] [CBFilter]: The CreateFileDirect method now uses the security attribute of the user-mode calling thread when creating a handle to the file. This way, the caller cannot get a handle with SYSTEM ownership.
[NEW] [CBFilter]: The CreateFileDirect method can now be used with most classes of GetFileInformationByHandleEx Windows API functions and other functions that use the same mechanism as GetFileInformationByHandleEx.
[FIX] [CBFilter]: The CreateFileDirect method didn't report or return errors.
[FIX] [CBFilter]: The Flush method of the CBFSFilterStream class should not do anything in read-only streams.

Version: 20.0.7506
Date: July 20, 2020

[FIX] [CBilter]: During driver update, if the existing driver is busy, the installation procedure stops trying to shut down the driver after 10 seconds, and reports that reboot is required.
[FOX] [CBProcess]: Regression in build 7501: the driver could not be loaded on some systems.

Version: 20.0.7501
Date: July 15, 2020

[FIX] [CBFilter]: When ProcessFailedIORequests was set to true and a request failed, the driver didn't fire some kinds of events or passed 0 in the Status parameter.
[FIX] [CBFilter]: Potential BSODs under specific circumstances have been addressed.
[FIX] [CBFilter]: The CleanupContext event was not always fired correctly.
[FIX] [CBFilter]: Improvements in the AddHeader sample.
[FIX] [CBFilter]: In operations with named streams, the name of the file and stream, passed to event handlers, was separated with the inappropriate extra backslash.

Version: 20.0.7452
Date: May 27, 2020

[NEW] RAD Studio 10.4 support in Delphi and C++Builder editions
[FIX] [CBFS Filter]: In *RenameOrMoveFile events, the new filename was wrong in the case of network disk.

Version: 20.0.7446
Date: May 21, 2020

[NEW] [CBRegistry]: Added ResolveNtNameToWin32Name configuration setting to tell the component that it must convert the registry path in the OnBeforeCreateKey event to Win32 format.
[FIX] Regression - Default rules were not working.
[FIX] [CBRegistry]: AddFilterRule and AddDefaultRule didn't accept paths in Win32 format (NT-native format was expected).
[FIX] [CBRegistry]: Non-zero result code, returned from the OnPostEnumerateKey, OnPostEnumerateValueKey, OnPostQueryKey, and OnPostQueryValueKey events, was not handled properly by the driver.
[FIX] [CBFilter]: Passing the value of 65536 and higher to the AddBytesToWriteBuffer method could cause a BSOD due to the loss of precision.
[FIX] [CBFilter]: If the file was opened and one of its parent directories was renamed, opening the file again caused the old path to be passed to the OnAfterOpenFile event.
[FIX] [CBProcess]: The AddNonFilteredProcessByName method could deadlock.
[FIX] [CBProcess]: Setting the FilterOwnRequests configuration setting to false had no effect

Version: 20.0.7433
Date: May 8, 2020

[IMPORTANT] [CBFilter]: The AddBytesToWriteBuffer method now accepts values above 32KB and will also verify that value passed is a multiple of the storage sector size. This does not change the behavior of the method. Previously values were rounded up to a multiple of the storage sector size.
[FIX] cbprocess.cab and cbregistry.cab could not be unpacked by a 32-bit process running on 64-bit Windows 10 due to an 8.3 bug in the SetupIterateCabinet Windows API function. Workaround added.
[FIX] In the non-Unicode versions of some APIs (Delphi, C++ Builder, C++), the events which include changeable string parameters could randomly fail.
[FIX] [CBFilter]: The UNINSTALL_VERSION_PREVIOUS flag was not respected during installation of drivers in cbfilter.cab.
[FIX] [CBFilter]: Two or more rules with a partially matching path component (e.g., c:\test\my\etc\* and c:\test\my_folder\etc\*) were considered the same.
[FIX] [CBFilter]: Some BSODs have been addressed.
[FIX] [CBFilter]: The loaded driver could block operations with reparse points and memory-mapped files.
[FIX] [CBFilter]: OnAfterCleanupFile and OnAfterCloseFile were not fired for directories.
[FIX] [CBFilter]: OnAfterCreateFile and OnNotifyCreateFile were not fired in the case of error even when ProcessFailedRequests was true.

Version: 20.0.7417
Date: April 22, 2020

[FIX] [CBFilter]: FileContext and HandleContext values modified in On*CleanupFile and On*CloseFile were not passed back to the driver and to the corresponding events.

Version: 20.0.7408
Date: April 13, 2020

[FIX] Various stability improvements.
[FIX] [CBFilter]: Operations performed with the handle that was returned by CreateFileDirect(Synchronized = true), could lead to a BSOD.
[FIX] [CBFilter]: Rules could stay if the controller application crashed.

Download Changelog