Recently encountered a problem and needs: according to the policy configuration, prevent copying files to the usb drive, and requirements in R3.
Thank you very much for wu on the key technical points of advice!
engineering download
Attached please see the bottom of the post
SrcUDiskCpyManager_V2013_1012_1653. Rar
feeling
This two weeks are doing the project, the details is very much, one by one small problem, one by one.
I think, five days to get this component. If not from has been achieved in the Demo, out of the corresponding function, is done.
prevent to U disk copy of the content
file
folder
The specific file folder there any directory file suffix
test
Today after themselves in the real machine test, the following test conclusion
At the request of the Win7X64 issued by demand.
At the request of the WinXpX86Sp3 issued by demand.
Win7X86 no physical machine, Vmware of Windows not know I see U disk, suspended the platform of the test.
Use ApiMonitor can see Win7X64 and win7X86 file operations, call the COM API is the same.
software implementation approach
* WinXp, Hook Win32API, banned by the resource manager to U disk copy files
* Windows 7 (x86 / x64), Hook COM API, banned by the resource manager to U disk copy files
software components
* CtrlProg. Exe: control procedures, is responsible for the strategy of custom, the control of the Hook DLL (install and uninstall)
* LsApiHook. DLL: Hook Win32API, the realization of U disk DLP under WinXp
Hook function list: CopyFileExW
CreateFileW
* LsComHookProxy. DLL, Hook COM API, implementation in Windows 7 U disk DLP (x86 / x64)
Hook function list: CoCreateInstance,
IFileOperation: : CopyItems
IFileOperation: : MoveItems
IFileOperation: : NewItem
IFileOperation: : RenameItem
technical point
* COM interface methods address
* C + + program invokes the C way of COM interface methods
strategy custom
* disable/enable usb drive to copy folder
* disable/enable usb drive to copy specific file suffix
In the product, with the actual demand of refinement, elaboration strategy, refine the document control.
note
* in the product, control program to protect by the driver, prevent be turned off.
* policies issued, generally is not issued by a control program.
* products, specific suffix type of document, to the actual content determination by the PE file, rather than a file suffix
[*] software screenshots
