What's New in CBFS Filter 2020

CBFS Filter 2020 is the latest version of Callback Technologies' popular operating system filtering products; it represents a major upgrade from the following products, which have all been combined in the 2020 product line: CBFS Filter 2017, CBFS Registry 2017, and CBFS Process 2017. The CBFS Filter 2020 toolkit includes redesigned component APIs, extensively revised and expanded documentation, and numerous internal changes and upgrades.

This article is intended to provide both a high level overview of new features and functionality, as well as in-depth details about how to upgrade existing code to CBFS Filter 2020 from CBFS Filter 2017, CBFS Registry 2017, and/or CBFS Process 2017. Please refer to the CBFS Filter 2020 product page and documentation for more information.

Contents

• What's New
  • Registry and Process Functionality Now Included
  • Updated Development Experience
  • New Features & Other Changes
  • New Component: CBMonitor
• Upgrading
  • General
  • CBFilter Component
  • CBRegistry Component
  • CBProcess Component

What's New

Registry and Process Functionality Now Included

The 2020 product line sees two of our previously-separate offerings, CBFS Registry and CBFS Process, included as CBRegistry and CBProcess components in the CBFS Filter product. Consolidating our product line in this manner allows us to deliver greater value to our customers, and decreases development and maintenance efforts.

Any existing application built with CBFS Filter 2017, CBFS Registry 2017, or CBFS Process 2017 (or previous versions of the same) can be upgraded to CBFS Filter 2020. Refer to the Upgrading section, below, for more information.

Updated Development Experience

A primary goal for Callback Technologies' 2020 product line was to revisit and refine the developer experience. Our efforts in this area have resulted in a number of changes across the board for each product, a few of which are worth noting here.

The CBFS Filter user mode API has been redesigned. The new API is designed to be easier to understand and to use; it is more streamlined and consistent than in previous versions, but just as flexible and performant. Additional details about how the API has changed can be found in the Upgrading section, below.

The product's documentation has also been extensively revised and expanded, making it easier to read and more helpful overall; and the included demo projects have been improved so as to better illustrate the usage of the components.

New Features & Changes

CBFS Filter 2020 includes numerous new features and changes. Here are some of the highlights:

• A Java edition of the product is now available (Windows only).
• Additional logging can now be enabled using the LoggingEnabled configuration setting.
• A number of new events (previously known as "callbacks") have been added to the CBFilter component, for additional flexibility.
• The internal libraries used to facilitate communication between the CBFS Filter system drivers and user mode components have been rewritten to improve performance.

New Component: CBMonitor

CBFS Filter 2020 introduces a brand-new component: CBMonitor. The CBMonitor component is designed to be a "monitoring-only" subset of the CBFilter component, and is intended to target use-cases such as logging, auditing, and other "record-keeping" scenarios. For more information about the CBMonitor component, refer to the CBFS Filter 2020 documentation.

Upgrading

This section contains information helpful for upgrading existing code to CBFS Filter 2020 from CBFS Filter 2017, CBFS Registry 2017, and/or CBFS Process 2017. Please note that a number of finer details and edition-specific differences are omitted due to the general-purpose nature of this content; such information can be found in the CBFS Filter 2020 documentation applicable to your edition.

General

When upgrading to CBFS Filter 2020, there are a number of general changes to keep in mind:

• The components in the toolkit have been renamed:
  • The CBFSFilter component has been renamed to CBFilter.
  • The CBFSRegistry component has been renamed to CBRegistry.
  • The CBFSProcess component has been renamed to CBProcess.
• A number of infrequently-used properties have been converted to configuration settings (which are get/set using the Config method).
• The manner in which events (previously known as "callbacks") are used has changed in some editions.
• The parameter list for a number of events has changed; and the types of parameters passed to events have been simplified in general.
• Many constants have been renamed; and all constants have moved to a dedicated, product-wide "Constants" class.
• The manner in which errors are reported during events has changed for some editions.
• The end-user driver deployment procedure has changed.
• The licensing scheme for the product has changed.
• The assembly and namespace names have changed in the .NET edition.

CBFilter Component

The following table describes how to upgrade from the old CBFSFilter component API to the new CBFilter component API:

CBFSFilter Component (2017)	CBFilter Component (2020)
Properties
BypassDriverStack property	This property is now the SendRequestsViaDriverStack configuration setting (and its default value has been inverted due to the name change).
DisableRemoteCaching property	This property is now the CacheRemoteFilesLocally configuration setting.
FilterPresent property	Removed.
MinWorkerThreadCount and MaxWorkerThreadCount properties	These properties are now configuration settings.
OwnProcessFiltered property	This property is now the FilterOwnRequests configuration setting.
ProcessCachedReadWriteCallbacks property	Renamed to ProcessCachedIORequests.
ProcessMountVolumeEvent property	Renamed to FireVolumeEvents.
ReadWriteFileInPreCreatePath property	This property is now the AllowFileAccessInBeforeOpen configuration setting.
ResolveNtDeviceToDriveLetter property	This property is now a configuration setting.
SerializeCallbacks property	Renamed to SerializeEvents.
Methods
AddFilterAccessRule method	Merged into the AddFilterRule method.
AddFilterAccessRuleEx method	Merged into the AddFilterRuleEx method.
AddFilterDefaultRule method	Renamed to AddDefaultRule.
AddPassThroughRule and AddPassThroughAccessRule methods	Merged into a single method named AddPassthroughRule.
AddPassThroughRuleEx and AddPassThroughAccessRuleEx methods	Merged into a single method named AddPassthroughRuleEx.
AddReparseFileNameRule and AddReparseFileNameRuleEx methods	Merged into a single method named AddReparseRule.
AttachFilter method	Renamed to StartFilter.
CreateNonCbFile and OpenFile methods	Merged into a single method named CreateFileDirect.
DeleteFilterDefaultRule method	Renamed to DeleteDefaultRule.
DeletePassThroughRule and DeleteAllPassThroughRules methods	Renamed to DeletePassthroughRule and DeleteAllPassthroughRules.
DeleteReparseFileNameRule and DeleteAllReparseFileNameRules methods	Renamed to DeleteReparseRule and DeleteAllReparseRules.
DetachFilter and DetachFilterEx methods	Merged into a single method named StopFilter.
DisableDefaultRules method	Renamed to SuspendDefaultRules.
EnableProcessProtection and DisableProcessProtection methods	Merged into a single method named ToggleProcessProtection.
GetDriverStatus method	Split into the GetDriverStatus and GetDriverVersion methods.
GetFilterDefaultRule and GetFilterDefaultCount methods	Removed. This information is available by calling the CreateDefaultRulesSnapshot method, which populates the DefaultRules collection property (.NET/Java editions) or the various DefaultRule* properties (other editions).
GetFilterRule and GetFilterRuleEx methods	Removed. This information is available via the FilterRules collection property (.NET/Java editions) or the various FilterRule* properties (other editions).
GetPassThroughRule and GetPassThroughRuleEx methods	Removed. This information is available via the PassthroughRules collection property (.NET/Java editions) or the various PassthroughRule* properties (other editions).
GetReparseFileNameRule and GetReparseFileNameRulesCount methods	Removed. This information is available by calling the CreateReparseRulesSnapshot method, which populates the ReparseRules collection property (.NET/Java editions) or the various ReparseRule* properties (other editions).
Install and Uninstall methods	Usage has changed; refer to the documentation for more information.
SetEndOfFile method	Renamed to SetFileSizeDirect.
SetRegistrationKey method	Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
SuspendFileCallbacks method	Renamed to SuspendFileEvents.
UninstallEx method	Removed.
Events
CanFileBeDeletedC, PostCanFileBeDeletedC, and CanFileBeDeletedN events	Renamed to BeforeCanFileBeDeleted, AfterCanFileBeDeleted, and NotifyCanFileBeDeleted.
CleanupFileC and CleanupFileN events	Split and renamed to BeforeCleanupFile, AfterCleanupFile, and NotifyCleanupFile.
CloseEnumeration event	Renamed to AfterCloseEnumeration.
CloseFileC and CloseFileN events	Split and renamed to BeforeCloseFile, AfterCloseFile, and NotifyCloseFile.
CreateFileC, PostCreateFileC, and CreateFileN events	Renamed to BeforeCreateFile, AfterCreateFile, and NotifyCreateFile.
EnumerateDirectoryC and EnumerateDirectoryN events	Renamed to AfterEnumerateDirectory and NotifyEnumerateDirectory.
FilterAttach and FilterDetach events	Renamed to FilterStart and FilterStop.
FilterAttachToFSVolumeC and FilterAttachToFSVolumeN events	Split and renamed to BeforeFilterAttachToVolume, AfterFilterAttachToVolume, and NotifyFilterAttachToVolume.
FilterDetachFromFSVolumeC and FilterDetachFromFSVolumeN events	Renamed to AfterFilterDetachFromVolume and NotifyFilterDetachFromVolume.
PostGetFileSizesC and GetFileSizesN events	Renamed to AfterGetFileSizes and NotifyGetFileSizes.
OpenFileC, PostOpenFileC, and OpenFileN events	Renamed to BeforeOpenFile, AfterOpenFile, and NotifyOpenFile.
ReadFileC, PostReadFileC, and ReadFileN events	Renamed to BeforeReadFile, AfterReadFile, and NotifyReadFile.
RenameOrMoveFileC, PostRenameOrMoveFileC, and RenameOrMoveFileN events	Renamed to BeforeRenameOrMoveFile, AfterRenameOrMoveFile, and NotifyRenameOrMoveFile.
ReparseFileName event	Usage has changed; refer to the documentation for more information.
SetAllocationSizeC and SetAllocationSizeN events	Split and renamed to BeforeSetAllocationSize, AfterSetAllocationSize, and NotifySetAllocationSize.
SetEndOfFileC and SetEndOfFileN events	Split and renamed to BeforeSetFileSize, AfterSetFileSize, and NotifySetFileSize.
SetFileAttributesC and SetFileAttributesN events	Split and renamed to BeforeSetFileAttributes, AfterSetFileAttributes, and NotifySetFileAttributes.
SetFileSecurityC and SetFileSecurityN events	Split and renamed to BeforeSetFileSecurity, AfterSetFileSecurity, and NotifySetFileSecurity.
UserFSRequestC, PostUserFSRequestC, and UserFSRequestN events	Renamed to BeforeFsctl, AfterFsctl, and NotifyFsctl.
WriteFileC, PostWriteFileC, and WriteFileN events	Renamed to BeforeWriteFile, AfterWriteFile, and NotifyWriteFile.

CBRegistry Component

The following table describes how to upgrade from the old CBFSRegistry component API to the new CBRegistry component API:

CBFSRegistry Component (2017)	CBRegistry Component (2020)
Properties
MinWorkerThreadCount and MaxWorkerThreadCount properties	These properties are now configuration settings.
SerializeCallbacks property	Renamed to SerializeEvents.
Methods
AddNonFilteredProcessById and AddNonFilteredProcessByName methods	Renamed to AddIgnoredProcessById and AddIgnoredProcessByName.
GetDriverStatus method	Split into the GetDriverStatus and GetDriverVersion methods.
Install and Uninstall methods	Usage has changed; refer to the documentation for more information.
RemoveNonFilteredProcessById and RemoveNonFilteredProcessByName methods	Renamed to RemoveIgnoredProcessById and RemoveIgnoredProcessByName.
SetRegistrationKey method	Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
UninstallEx method	Removed.
Events
PreCloseKey and PostCloseKey events	Renamed to BeforeCloseKey and AfterCloseKey.
PreCreateKey and PostCreateKey events	Renamed to BeforeCreateKey and AfterCreateKey.
PreDeleteKey and PostDeleteKey events	Renamed to BeforeDeleteKey and AfterDeleteKey.
PreDeleteValueKey and PostDeleteValueKey events	Renamed to BeforeDeleteValue and AfterDeleteValue.
PreEnumerateKey and PostEnumerateKey events	Renamed to BeforeEnumerateKey and AfterEnumerateKey.
PreEnumerateValueKey and PostEnumerateValueKey events	Renamed to BeforeEnumerateValue and AfterEnumerateValue.
PreOpenKey and PostOpenKey events	Renamed to BeforeOpenKey and AfterOpenKey.
PreQueryKey and PostQueryKey events	Renamed to BeforeQueryKey and AfterQueryKey.
PreQueryMultipleValueKey and PostQueryMultipleValueKey events	Removed.
PreQueryValueKey and PostQueryValueKey events	Renamed to BeforeQueryValue and AfterQueryValue.
PreRenameKey and PostRenameKey events	Renamed to BeforeRenameKey and AfterRenameKey.
PreSetInformationKey and PostSetInformationKey events	Renamed to BeforeSetKey and AfterSetKey.
PreSetValueKey and PostSetValueKey events	Renamed to BeforeSetValue and AfterSetValue.

CBProcess Component

The following table describes how to upgrade from the old CBFSProcess component API to the new CBProcess component API:

CBFSProcess Component (2017)	CBProcess Component (2020)
Properties
MinWorkerThreadCount and MaxWorkerThreadCount properties	These properties are now configuration settings.
SerializeCallbacks property	Renamed to SerializeEvents.
Methods
AddNonFilteredProcessById and AddNonFilteredProcessByName methods	Renamed to AddIgnoredProcessById and AddIgnoredProcessByName.
GetDriverStatus method	Split into the GetDriverStatus and GetDriverVersion methods.
Install and Uninstall methods	Usage has changed; refer to the documentation for more information.
RemoveNonFilteredProcessById and RemoveNonFilteredProcessByName methods	Renamed to RemoveIgnoredProcessById and RemoveIgnoredProcessByName.
SetRegistrationKey method	Removed. Refer to the "Licensing Instructions" topic in the documentation for information about how to license the component for use in each edition.
UninstallEx method	Removed.