CBFS Filter 2022 Changelog

This document provides high-level information about new features, fixes, and functionality changes between minor versions releases of CBFS Filter. The information provided here is also available as an RSS feed.

For more details or if you have any questions please contact support@callback.com

Version: 22.0.8678
Date: October 5, 2023

  • [IMPORTANT] [CBMonitor, CBFilter] The driver now remembers all file names while the file is opened. This means that after a file is moved/renamed or a hardlink is created, all known names are matched against both filter rules and passthrough rules. Complete closing of a file clears the list of known names, so after the file is reopened, old names and possible hard links are not known.
  • [NEW] [CBMonitor, CBFilter] When the SerializeAccess configuration setting was true, the AfterCreateFile/AfterOpenFile events still were exclusive.
  • [FIX] The drivers could not be installed on Windows 2012 R2 Server due to the problems with signature validation (the OS doesn't accept Microsoft's own SHA2 signature). The INSTALL_FORCE_SHA1_DRIVERS flag was added to address this problem.
  • [FIX] [CBMonitor, CBFilter] Various stability improvements.

Version: 22.0.8591
Date: July 10, 2023

  • [FIX] [CBFilter] File and Handle contexts could be lost in AfterCreateFile/AfterOpenFile when they were set in BeforeCreateFile/BeforeOpenFile.
  • [FIX] [CBFilter] If ModifiableReadWriteBuffers config setting was set to false (default) and AddBytesToWriteBuffer was called, a filesystem driver could overwrite the passed buffer. Now, both this issue is fixed, and the AddBytesToWriteBuffer sets ModifiableReadWriteBuffers to true.

Version: 22.0.8573
Date: June 22, 2023

  • [NEW] [CBFilter] Now, the CreateFileDirect method can open files with UNC paths.
  • [FIX] The driver could not be loaded (crashed) on Windows 11 for ARM.
  • [FIX] [CBFilter] Deletion could not be silently denied by simply setting ProcessRequest to false in BeforeCanFileBeDeleted.

Version: 22.0.8558
Date: June 7, 2023

  • [NEW] [CBMonitor, CBFilter] Now, the CreateFileDirect method can use the DesiredAccess, CreationDisposition, and FlagsAndAttributes parameters when the Synchronize parameter is true.
  • [NEW] [CBMonitor, CBFilter] When StopFilter is called, the component now waits until all pending callbacks come from the kernel and fires the appropriate events.
  • [NEW] [CBFilter] Handles, created using the CreateFileDirect method, can now be used in calls to the BackupRead Windows API function.
  • [NEW] [CBFilter] Added the SerializeAccess configuration setting.
  • [FIX] [CBMonitor, CBFilter] When filtering was started using StartFilter, user-mode callbacks could be called before the initialization was complete, and this could lead to an internal error.
  • [FIX] [CBMonitor, CBFilter] An Invalid Parameter error could occur when CreateFileDirect was used and there was an RDP/Terminal Services session active and the application was run with limited rights.

Version: 22.0.8485
Date: March 26, 2023

  • [FIX] Improved the installation procedure in situations where the driver is busy and cannot be updated immediately during the Install() call.
  • [FIX] A component could block on a StopFilter call.
  • [FIX] [CBFilter] invalid memory access in the ReparseFileName callback function that occurred when a new file name was set.
  • [FIX] [CBMonitor, CBFilter] Added a workaround to some Windows glitch, where a drive's DOS device name resolved by Windows was not then usable in other Windows calls. This could lead to impossibility to use a filter rule which was specific to that drive.
  • [FIX] [CBFilter] [.NET, Java, Python] When the ReparseWithTag event was enabled with a rule and a symlink was accessed (e.g., a directory symlink), the Invalid Memory Access error happened.
  • [FIX] [CBFilter] The SetFileInformationDirect method could fail with the AccessViolation error in the kernel and didn't report this error back.
  • [FIX] [CBFilter] Improved operation of the AddBytesToWriteBuffer method.

Version: 22.0.8465
Date: March 6, 2023

  • [IMPORTANT] [CBMonitor, CBFilter] The StopFilter method is synchronous now - the WaitForDetach parameter has been made obsolete and its value is ignored.
  • [NEW] [CBMonitor, CBFilter] The Altitude property had to be set after a call to Initialize. Now, this is not required as Initialize reads the value from the registry.
  • [FIX] An Access Violation error could happen when a filter is stopped (v2022 regression).
  • [FIX] [CBProcess] Specifying just thread operations to be captured didn't work right (wrong events were fired).

Version: 22.0.8441
Date: February 10, 2023

  • [FIX] If an error occured in one of the methods, in some cases, it was not reported via OnError, and an exception (where applicable) didn't contain an error message.
  • [FIX] [CBFilter] The AfterLock event passed request parameters incorrectly.
  • [FIX] [CBFilter] CreateFileDirect could fail to work when the process didn't have sufficient rights.

Version: 22.0.8425
Date: January 25, 2023

  • [IMPORTANT] [CBProcess] The EventsToFire configuration setting now determines, which events are fired. Its default value is 0, meaning that no events are fired. An application needs to update the setting's value in order to receive events.
  • [FIX] [CBFilter] Fixed reporting of an internal error from the ReparseWithTag and ReparseFileName events
  • [FIX] [CBProcess] The INSTALL_REMOVE_OLD_VERSIONS and UNINSTALL_VERSION_PREVIOUS flags did not work during installation/deinstallation of the driver.

Version: 22.0.8400
Date: December 31, 2022

  • [NEW] Initial release of version 2022
  • [IMPORTANT] The Altitude property is a string now, which better conforms to Microsoft altitude assignment rules.
  • [IMPORTANT] The Initialize method will fail with an error if the kernel-mode driver is not installed OR if the version of the driver is lower than the version of the user-mode library.
  • [IMPORTANT] Mask matching in rules has been extended to support inverted rules.
  • [IMPORTANT] [CBMonitor] If an application configures the rule(s) so that both the ACCESS_READ_ONLY access flag and any callback/notify flags are in effect during the same file open operation, the ACCESS_READ_ONLY access flag will not be taken into account. The application can deny file opening or modify the way the file is accessed from the BeforeOpenFile event handler.
  • [IMPORTANT] [CBMonitor] If the ResolveNtDeviceToDriveLetter configuration setting is true, enumeration of default and reparse rules as well as the GetReparseRuleByMask method try to resolve the path in the mask back to DOS device name.
  • [IMPORTANT] [CBMonitor] The values of the FS_CE_REPARSE_FILENAME and FS_CE_REPARSE_TAG constants have been changed. If an application uses numeric values and not constants, those values need to be updated.
  • [IMPORTANT] [CBFilter] The {Before|After}CreateFile and {Before|After}OpenFile events got new parameters, reserved for future use.
  • [NEW] [CBMonitor] One can specify the mask that excludes Alternate Data Streams
  • [NEW] [CBMonitor] New events, related to reparse point operations (*{Get|Set}ReparsePoint).
  • [NEW] [CBMonitor] New events, related to operations with extended attributes (*{Query|Set}Ea).
  • [NEW] [CBMonitor] Added the Flags and Index parameters to AfterEnumerateDirectory and NotifyEnumerateDirectory events
  • [NEW] [CBMonitor] The GetDOSPathName and GetNTPathName helper methods has been added.
  • [NEW] [CBMonitor] The \*CanFileBeDeleted and \*DeleteFile events got the RequestType parameter
  • [NEW] [CBFilter] Added the BeforeEnumerateDirectory event
  • [NEW] [CBFilter] Added the FileContext and HandleContext parameters to the BeforeCreateFile and BeforeOpenFile events
  • [NEW] [CBFilter] Added the FileContext and HandleContext parameters to the CloseEnumeration event
  • [NEW] [CBFilter] The ReparseWithTag event got the NewFileName parameter
  • [NEW] [CBRegistry] The ForceAppPermissionCheck and ForceSecurityChecks configuration settings have been added
  • [NEW] [CBRegistry] The \*{Get|Set}KeySecurity events have been added.

Version: 20.0.8404
Date: January 4, 2023

  • [IMPORTANT] [CBProcess] The EventsToFire configuration setting now determines, which events are fired. Its default value is set to fire all events, however, for performance reasons, it is recommended that an application updates the setting's value in order to receive only the needed events.
  • [FIX] [CBFilter] Fixed reporting of an internal error from the ReparseWithTag and ReparseFileName events

Version: 20.0.8351
Date: November 12, 2022

  • [FIX] An attempt to operate with rules while the filter was not initialized returned a confusing error code 3 in some situations. Now, a more meaningul ERROR_NOT_READY error is returned.
  • [FIX] Various stability improvements.

Version: 20.0.8317
Date: October 9, 2022

  • [FIX] [CBRegistry] In the PreCreateOpenKeyEx event, the key opening status was overriden in some cases.
  • [FIX] [CBFilter] If both AfterSetFileInfo and AfterRenameOrMoveFile events were enabled, the ProcessFailedRequests property was set to true, and an error occured, AfterSetFileInfo was fired and AfterRenameOrMoveFile was lost.

Version: 20.0.8124
Date: March 30, 2022

  • [FIX] BSOD could occur in rare cases if the user-mode application was terminated.
  • [FIX] When a passthrough rule was added in addition to filter rules, events could occasionally fire or access could be blocked for seemingly unrelated files and operations.
  • [FIX] Driver Verifier reported allocation of memory in non-paged pool without Nx flag. Workardound added.

Version: 20.0.8069
Date: February 3, 2022

  • [NEW] Added support for x64 operations on Windows 11/ARM64 systems. Now, the installation methods executed in x64 mode can install the drivers and the helper DLL to such as system.
  • [FIX] If a legacy filter driver was present in the filter stack, the CBFilter driver could block the renaming operation with the "NOT SAME DEVICE" error.
  • [FIX] If the FlushOnClose parameter was set, the cache flush procedure would reset its size to zero, which would also change the SharedCacheMap size in other processes (threads) that accessed the file simultaneously. As a result, the file could be corrupted.
  • [FIX] In the case when the low-level filter returned STATUS_REPARSE, The CBFilter driver treated it as a successful open operation and sent another request to the filesystem. This caused a conflict with a third-party driver resulting in a crash.

Version: 20.0.8047
Date: January 12, 2022

  • [FIX] [CBFilter] Improved handling of rename operations when they are performed over reparse points or to a different drive.
  • [FIX] [CBFilter] In rare cases, in the AfterRenameOrMoveFile event, both old and new names could be the same (equal to the new name).
  • [FIX] Improved the way rules are stored in the tree to avoid desynchronization of rules between the kernel and the user mode in complex dynamic scenarios.

Version: 20.0.8008
Date: December 4, 2021

  • [NEW] Rule masks may contain the \\?\ prefix. This is the most useful for VolumeGUID-based masks.

Version: 20.0.7982
Date: November 8, 2021

  • [FIX] A sporadic C++ exception could happen upon deletion of the component or application shutdown due to a compiler quirk.

Version: 20.0.7979
Date: November 5, 2021

  • [NEW] Process tracking library improved, so the loaded driver should cause a slightly lower effect on system operations.
  • [FIX] [CBFilter] When the volume was re-mounted by the OS with handles on it not being closed beforehand, the driver didn't have a chance to dispose of already invalid information about the volume, so a subsequent access to the volume's files using CreateFileDirect could fail. A workaround for this unexpected OS behavior has been added.
  • [FIX] [CBFilter] A crash could happen in Windows Server when a specific network request was made to a monitored disk.

Version: 20.0.7905
Date: August 23, 2021

  • [NEW] nodeJS edition (Beta).

Version: 20.0.7836
Date: June 15, 2021

  • [NEW] Added an option to add and delete default rules without requiring administrative permissions. To prevent misuse of this option, the ForceAdminRightsForDefaultRules config setting has been added.
  • [FIX] When CBFilter and CBRegistry worked in parallel, they competed for RuleSet IDs, leading to one of the components not firing events.
  • [FIX] [.NET Standard] Removed various attribute class types that are already present in .NET Standard core assemblies.
  • [NEW] [CBFilter]: Improved the speed of operations of calling the user mode for firing of events.
  • [NEW] [CBFilter]: Improved the speed of operations with file names when a file is opened or when an event fires.
  • [FIX] [CBFilter]: In some cases, On\*Fsctl events were skipped.
  • [FIX] [CBFilter]: Masks that include an absolute path but no drive name (letter or GUID) didn't work.
  • [FIX] [CBFilter]: Redirection to another volume using the OnReparseFileName event didn't work in some cases.
  • [FIX] [CBFilter]: An internal/unhandled error that occurred during handling of file opening could lead to blocking of the file open operation.
  • [FIX] [CBFilter]: Execution of the OnWorkerThreadTermination event handler was not fully completed before the component was destroyed, which could lead to an Access Violation upon shutdown.
  • [FIX] [CBFilter]: The AddHeader method in Legacy mode failed with assertion.
  • [FIX] [CBRegistry]: Default rules didn't work in some cases.
  • [FIX] [CBFilter]: Regression: Events, related to new volumes being added and removed from the system, were not fired.
  • [FIX] [CBFilter]: Regression: Hiding an entry in OnAfterEnumerateDirectory could randomly cause a crash.
  • [FIX] [CBProcess]: Error was not reported properly by StartFilter.

Version: 20.0.7663
Date: December 24, 2020

  • [FIX] Regression: When the filter was stopped and restarted, rules were lost.
  • [FIX] [CBRegistry]: The component did not work on Windows Vista.

Version: 20.0.7656
Date: December 17, 2020

  • [FIX] [CBFilter]: Access to some rule-related methods could cause the component to be blocked on StopFilter.
  • [FIX] [CBFilter]: CanDelete parameter was always true in OnAfterCanFileBeDeleted and OnNotifyCanFileBeDeleted events.
  • [FIX] [CBProcess]: The component did not work on Windows Vista.

Version: 20.0.7647
Date: December 8, 2020

  • [NEW] Global performance optimizations in rule handling.
  • [NEW] [CBFilter]: Minor performance optimization in GetOriginatorProcessName.
  • [FIX] Kernel-mode logging didn't work when enabled via the registry.
  • [FIX] In certain rare combinations of rule settings which included the same path, only the first rule was taken into account.

Version: 20.0.7543
Date: August 26, 2020

  • [IMPORTANT] [CBFilter]: The reparse buffer pointer in the OnReparseWithTag event previously pointed to the data block after the fixed header (which was different from the documentation). Now, it points to the beginning of the structure.
  • [IMPORTANT] [CBFilter]: The CreateFileDirect method now uses the security attribute of the user-mode calling thread when creating a handle to the file. This way, the caller cannot get a handle with SYSTEM ownership.
  • [NEW] [CBFilter]: The CreateFileDirect method can now be used with most classes of GetFileInformationByHandleEx Windows API functions and other functions that use the same mechanism as GetFileInformationByHandleEx.
  • [FIX] [CBFilter]: The CreateFileDirect method didn't report or return errors.
  • [FIX] [CBFilter]: The Flush method of the CBFSFilterStream class should not do anything in read-only streams.

Version: 20.0.7506
Date: July 20, 2020

  • [FIX] [CBilter]: During driver update, if the existing driver is busy, the installation procedure stops trying to shut down the driver after 10 seconds, and reports that reboot is required.
  • [FOX] [CBProcess]: Regression in build 7501: the driver could not be loaded on some systems.

Version: 20.0.7501
Date: July 15, 2020

  • [FIX] [CBFilter]: When ProcessFailedIORequests was set to true and a request failed, the driver didn't fire some kinds of events or passed 0 in the Status parameter.
  • [FIX] [CBFilter]: Potential BSODs under specific circumstances have been addressed.
  • [FIX] [CBFilter]: The CleanupContext event was not always fired correctly.
  • [FIX] [CBFilter]: Improvements in the AddHeader sample.
  • [FIX] [CBFilter]: In operations with named streams, the name of the file and stream, passed to event handlers, was separated with the inappropriate extra backslash.

Version: 20.0.7452
Date: May 27, 2020

  • [NEW] RAD Studio 10.4 support in Delphi and C++Builder editions
  • [FIX] [CBFS Filter]: In *RenameOrMoveFile events, the new filename was wrong in the case of network disk.

Version: 20.0.7446
Date: May 21, 2020

  • [NEW] [CBRegistry]: Added ResolveNtNameToWin32Name configuration setting to tell the component that it must convert the registry path in the OnBeforeCreateKey event to Win32 format.
  • [FIX] Regression - Default rules were not working.
  • [FIX] [CBRegistry]: AddFilterRule and AddDefaultRule didn't accept paths in Win32 format (NT-native format was expected).
  • [FIX] [CBRegistry]: Non-zero result code, returned from the OnPostEnumerateKey, OnPostEnumerateValueKey, OnPostQueryKey, and OnPostQueryValueKey events, was not handled properly by the driver.
  • [FIX] [CBFilter]: Passing the value of 65536 and higher to the AddBytesToWriteBuffer method could cause a BSOD due to the loss of precision.
  • [FIX] [CBFilter]: If the file was opened and one of its parent directories was renamed, opening the file again caused the old path to be passed to the OnAfterOpenFile event.
  • [FIX] [CBProcess]: The AddNonFilteredProcessByName method could deadlock.
  • [FIX] [CBProcess]: Setting the FilterOwnRequests configuration setting to false had no effect

Version: 20.0.7433
Date: May 8, 2020

  • [IMPORTANT] [CBFilter]: The AddBytesToWriteBuffer method now accepts values above 32KB and will also verify that value passed is a multiple of the storage sector size. This does not change the behavior of the method. Previously values were rounded up to a multiple of the storage sector size.
  • [FIX] cbprocess.cab and cbregistry.cab could not be unpacked by a 32-bit process running on 64-bit Windows 10 due to an 8.3 bug in the SetupIterateCabinet Windows API function. Workaround added.
  • [FIX] In the non-Unicode versions of some APIs (Delphi, C++ Builder, C++), the events which include changeable string parameters could randomly fail.
  • [FIX] [CBFilter]: The UNINSTALL_VERSION_PREVIOUS flag was not respected during installation of drivers in cbfilter.cab.
  • [FIX] [CBFilter]: Two or more rules with a partially matching path component (e.g., c:\test\my\etc\* and c:\test\my_folder\etc\*) were considered the same.
  • [FIX] [CBFilter]: Some BSODs have been addressed.
  • [FIX] [CBFilter]: The loaded driver could block operations with reparse points and memory-mapped files.
  • [FIX] [CBFilter]: OnAfterCleanupFile and OnAfterCloseFile were not fired for directories.
  • [FIX] [CBFilter]: OnAfterCreateFile and OnNotifyCreateFile were not fired in the case of error even when ProcessFailedRequests was true.

Version: 20.0.7417
Date: April 22, 2020

  • [FIX] [CBFilter]: FileContext and HandleContext values modified in On*CleanupFile and On*CloseFile were not passed back to the driver and to the corresponding events.

Version: 20.0.7408
Date: April 13, 2020

  • [FIX] Various stability improvements.
  • [FIX] [CBFilter]: Operations performed with the handle that was returned by CreateFileDirect(Synchronized = true), could lead to a BSOD.
  • [FIX] [CBFilter]: Rules could stay if the controller application crashed.

Download Changelog