What's New in CBFS Filter 2020



CBFS Filter 2020 is the latest version of Callback Technologies' popular operating system filtering products; it represents a major upgrade from the following products, which have all been combined in the 2020 product line: CBFS Filter 2017, CBFS Registry 2017, and CBFS Process 2017. The CBFS Filter 2020 toolkit includes redesigned component APIs, extensively revised and expanded documentation, and numerous internal changes and upgrades.

This article is intended to provide both a high level overview of new features and functionality, as well as in-depth details about how to upgrade existing code to CBFS Filter 2020 from CBFS Filter 2017, CBFS Registry 2017, and/or CBFS Process 2017. Please refer to the CBFS Filter 2020 product page and documentation for more information.

Contents

What's New

Registry and Process Functionality Now Included

The 2020 product line sees two of our previously-separate offerings, CBFS Registry and CBFS Process, included as CBRegistry and CBProcess components in the CBFS Filter product. Consolidating our product line in this manner allows us to deliver greater value to our customers, and decreases development and maintenance efforts.

Any existing application built with CBFS Filter 2017, CBFS Registry 2017, or CBFS Process 2017 (or previous versions of the same) can be upgraded to CBFS Filter 2020. Refer to the Upgrading section, below, for more information.

Updated Development Experience

A primary goal for Callback Technologies' 2020 product line was to revisit and refine the developer experience. Our efforts in this area have resulted in a number of changes across the board for each product, a few of which are worth noting here.

The CBFS Filter user mode API has been redesigned. The new API is designed to be easier to understand and to use; it is more streamlined and consistent than in previous versions, but just as flexible and performant. Additional details about how the API has changed can be found in the Upgrading section, below.

The product's documentation has also been extensively revised and expanded, making it easier to read and more helpful overall; and the included demo projects have been improved so as to better illustrate the usage of the components.

New Features & Changes

CBFS Filter 2020 includes numerous new features and changes. Here are some of the highlights:

  • A Java edition of the product is now available (Windows only).
  • Additional logging can now be enabled using the LoggingEnabled configuration setting.
  • A number of new events (previously known as "callbacks") have been added to the CBFilter component, for additional flexibility.
  • The internal libraries used to facilitate communication between the CBFS Filter system drivers and user mode components have been rewritten to improve performance.

New Component: CBMonitor

CBFS Filter 2020 introduces a brand-new component: CBMonitor. The CBMonitor component is designed to be a "monitoring-only" subset of the CBFilter component, and is intended to target use-cases such as logging, auditing, and other "record-keeping" scenarios. For more information about the CBMonitor component, refer to the CBFS Filter 2020 documentation.

Upgrading

This section contains information helpful for upgrading existing code to CBFS Filter 2020 from CBFS Filter 2017, CBFS Registry 2017, and/or CBFS Process 2017. Please note that a number of finer details and edition-specific differences are omitted due to the general-purpose nature of this content; such information can be found in the CBFS Filter 2020 documentation applicable to your edition.

General

When upgrading to CBFS Filter 2020, there are a number of general changes to keep in mind:

  • The components in the toolkit have been renamed:
    • The CBFSFilter component has been renamed to CBFilter.
    • The CBFSRegistry component has been renamed to CBRegistry.
    • The CBFSProcess component has been renamed to CBProcess.
  • A number of infrequently-used properties have been converted to configuration settings (which are get/set using the Config method).
  • The manner in which events (previously known as "callbacks") are used has changed in some editions.
  • The parameter list for a number of events has changed; and the types of parameters passed to events have been simplified in general.
  • Many constants have been renamed; and all constants have moved to a dedicated, product-wide "Constants" class.
  • The manner in which errors are reported during events has changed for some editions.
  • The end-user driver deployment procedure has changed.
  • The licensing scheme for the product has changed.
  • The assembly and namespace names have changed in the .NET edition.

CBFilter Component

The following table describes how to upgrade from the old CBFSFilter component API to the new CBFilter component API:

CBFSFilter Component (2017) CBFilter Component (2020)
Properties
BypassDriverStack property This property is now the SendRequestsViaDriverStack configuration setting (and its default value has been inverted due to the name change).
DisableRemoteCaching property This property is now the CacheRemoteFilesLocally configuration setting.
FilterPresent property Removed.
MinWorkerThreadCount and MaxWorkerThreadCount properties These properties are now configuration settings.
OwnProcessFiltered property This property is now the FilterOwnRequests configuration setting.
ProcessCachedReadWriteCallbacks property Renamed to ProcessCachedIORequests.
ProcessMountVolumeEvent property Renamed to FireVolumeEvents.
ReadWriteFileInPreCreatePath property This property is now the AllowFileAccessInBeforeOpen configuration setting.
ResolveNtDeviceToDriveLetter property This property is now a configuration setting.
SerializeCallbacks property Renamed to SerializeEvents.
Methods
AddFilterAccessRule method Merged into the AddFilterRule method.
AddFilterAccessRuleEx method Merged into the AddFilterRuleEx method.
AddFilterDefaultRule method Renamed to AddDefaultRule.
AddPassThroughRule and AddPassThroughAccessRule methods Merged into a single method named AddPassthroughRule.
AddPassThroughRuleEx and AddPassThroughAccessRuleEx methods Merged into a single method named AddPassthroughRuleEx.
AddReparseFileNameRule and AddReparseFileNameRuleEx methods Merged into a single method named AddReparseRule.
AttachFilter method Renamed to StartFilter.
CreateNonCbFile and OpenFile methods Merged into a single method named CreateFileDirect.
DeleteFilterDefaultRule method Renamed to DeleteDefaultRule.
DeletePassThroughRule and DeleteAllPassThroughRules methods Renamed to DeletePassthroughRule and DeleteAllPassthroughRules.
DeleteReparseFileNameRule and DeleteAllReparseFileNameRules methods Renamed to DeleteReparseRule and DeleteAllReparseRules.
DetachFilter and DetachFilterEx methods Merged into a single method named StopFilter.
DisableDefaultRules method Renamed to SuspendDefaultRules.
EnableProcessProtection and DisableProcessProtection methods Merged into a single method named ToggleProcessProtection.
GetDriverStatus method Split into the GetDriverStatus and GetDriverVersion methods.
GetFilterDefaultRule and GetFilterDefaultCount methods Removed. This information is available by calling the CreateDefaultRulesSnapshot method, which populates the DefaultRules collection property (.NET/Java editions) or the various DefaultRule* properties (other editions).
GetFilterRule and GetFilterRuleEx methods Removed. This information is available via the FilterRules collection property (.NET/Java editions) or the various FilterRule* properties (other editions).
GetPassThroughRule and GetPassThroughRuleEx methods Removed. This information is available via the PassthroughRules collection property (.NET/Java editions) or the various PassthroughRule* properties (other editions).
GetReparseFileNameRule and GetReparseFileNameRulesCount methods Removed. This information is available by calling the CreateReparseRulesSnapshot method, which populates the ReparseRules collection property (.NET/Java editions) or the various ReparseRule* properties (other editions).
Install and Uninstall methods Usage has changed; refer to the documentation for more information.
SetEndOfFile method Renamed to SetFileSizeDirect.
SetRegistrationKey method Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
SuspendFileCallbacks method Renamed to SuspendFileEvents.
UninstallEx method Removed.
Events
CanFileBeDeletedC, PostCanFileBeDeletedC, and CanFileBeDeletedN events Renamed to BeforeCanFileBeDeleted, AfterCanFileBeDeleted, and NotifyCanFileBeDeleted.
CleanupFileC and CleanupFileN events Split and renamed to BeforeCleanupFile, AfterCleanupFile, and NotifyCleanupFile.
CloseEnumeration event Renamed to AfterCloseEnumeration.
CloseFileC and CloseFileN events Split and renamed to BeforeCloseFile, AfterCloseFile, and NotifyCloseFile.
CreateFileC, PostCreateFileC, and CreateFileN events Renamed to BeforeCreateFile, AfterCreateFile, and NotifyCreateFile.
EnumerateDirectoryC and EnumerateDirectoryN events Renamed to AfterEnumerateDirectory and NotifyEnumerateDirectory.
FilterAttach and FilterDetach events Renamed to FilterStart and FilterStop.
FilterAttachToFSVolumeC and FilterAttachToFSVolumeN events Split and renamed to BeforeFilterAttachToVolume, AfterFilterAttachToVolume, and NotifyFilterAttachToVolume.
FilterDetachFromFSVolumeC and FilterDetachFromFSVolumeN events Renamed to AfterFilterDetachFromVolume and NotifyFilterDetachFromVolume.
PostGetFileSizesC and GetFileSizesN events Renamed to AfterGetFileSizes and NotifyGetFileSizes.
OpenFileC, PostOpenFileC, and OpenFileN events Renamed to BeforeOpenFile, AfterOpenFile, and NotifyOpenFile.
ReadFileC, PostReadFileC, and ReadFileN events Renamed to BeforeReadFile, AfterReadFile, and NotifyReadFile.
RenameOrMoveFileC, PostRenameOrMoveFileC, and RenameOrMoveFileN events Renamed to BeforeRenameOrMoveFile, AfterRenameOrMoveFile, and NotifyRenameOrMoveFile.
ReparseFileName event Usage has changed; refer to the documentation for more information.
SetAllocationSizeC and SetAllocationSizeN events Split and renamed to BeforeSetAllocationSize, AfterSetAllocationSize, and NotifySetAllocationSize.
SetEndOfFileC and SetEndOfFileN events Split and renamed to BeforeSetFileSize, AfterSetFileSize, and NotifySetFileSize.
SetFileAttributesC and SetFileAttributesN events Split and renamed to BeforeSetFileAttributes, AfterSetFileAttributes, and NotifySetFileAttributes.
SetFileSecurityC and SetFileSecurityN events Split and renamed to BeforeSetFileSecurity, AfterSetFileSecurity, and NotifySetFileSecurity.
UserFSRequestC, PostUserFSRequestC, and UserFSRequestN events Renamed to BeforeFsctl, AfterFsctl, and NotifyFsctl.
WriteFileC, PostWriteFileC, and WriteFileN events Renamed to BeforeWriteFile, AfterWriteFile, and NotifyWriteFile.

CBRegistry Component

The following table describes how to upgrade from the old CBFSRegistry component API to the new CBRegistry component API:

CBFSRegistry Component (2017) CBRegistry Component (2020)
Properties
MinWorkerThreadCount and MaxWorkerThreadCount properties These properties are now configuration settings.
SerializeCallbacks property Renamed to SerializeEvents.
Methods
AddNonFilteredProcessById and AddNonFilteredProcessByName methods Renamed to AddIgnoredProcessById and AddIgnoredProcessByName.
GetDriverStatus method Split into the GetDriverStatus and GetDriverVersion methods.
Install and Uninstall methods Usage has changed; refer to the documentation for more information.
RemoveNonFilteredProcessById and RemoveNonFilteredProcessByName methods Renamed to RemoveIgnoredProcessById and RemoveIgnoredProcessByName.
SetRegistrationKey method Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
UninstallEx method Removed.
Events
PreCloseKey and PostCloseKey events Renamed to BeforeCloseKey and AfterCloseKey.
PreCreateKey and PostCreateKey events Renamed to BeforeCreateKey and AfterCreateKey.
PreDeleteKey and PostDeleteKey events Renamed to BeforeDeleteKey and AfterDeleteKey.
PreDeleteValueKey and PostDeleteValueKey events Renamed to BeforeDeleteValue and AfterDeleteValue.
PreEnumerateKey and PostEnumerateKey events Renamed to BeforeEnumerateKey and AfterEnumerateKey.
PreEnumerateValueKey and PostEnumerateValueKey events Renamed to BeforeEnumerateValue and AfterEnumerateValue.
PreOpenKey and PostOpenKey events Renamed to BeforeOpenKey and AfterOpenKey.
PreQueryKey and PostQueryKey events Renamed to BeforeQueryKey and AfterQueryKey.
PreQueryMultipleValueKey and PostQueryMultipleValueKey events Removed.
PreQueryValueKey and PostQueryValueKey events Renamed to BeforeQueryValue and AfterQueryValue.
PreRenameKey and PostRenameKey events Renamed to BeforeRenameKey and AfterRenameKey.
PreSetInformationKey and PostSetInformationKey events Renamed to BeforeSetKey and AfterSetKey.
PreSetValueKey and PostSetValueKey events Renamed to BeforeSetValue and AfterSetValue.

CBProcess Component

The following table describes how to upgrade from the old CBFSProcess component API to the new CBProcess component API:

CBFSProcess Component (2017) CBProcess Component (2020)
Properties
MinWorkerThreadCount and MaxWorkerThreadCount properties These properties are now configuration settings.
SerializeCallbacks property Renamed to SerializeEvents.
Methods
AddNonFilteredProcessById and AddNonFilteredProcessByName methods Renamed to AddIgnoredProcessById and AddIgnoredProcessByName.
GetDriverStatus method Split into the GetDriverStatus and GetDriverVersion methods.
Install and Uninstall methods Usage has changed; refer to the documentation for more information.
RemoveNonFilteredProcessById and RemoveNonFilteredProcessByName methods Renamed to RemoveIgnoredProcessById and RemoveIgnoredProcessByName.
SetRegistrationKey method Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
UninstallEx method Removed.

We appreciate your feedback. If you have any questions, comments, or suggestions about this article please contact our support team at support@callbacktechnologies.com.