### Install and Start Filter Service (C++)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Installs the EaseFilter driver (requires admin privileges) and starts the filter service with combined filter types. A license key must be set.

```cpp
// C++ equivalent (requires admin privileges)
#include "FilterAPI.h"
#pragma comment(lib, "FilterAPI.lib")

SetRegistrationKey("your-license-key");

// Install driver once (run as administrator)
if (!InstallDriver())
{
    WCHAR errMsg[1024]; ULONG len = 1024;
    GetLastErrorMessage(errMsg, &len);
    wprintf(L"InstallDriver failed: %s\n", errMsg);
}

// Start with combined filter types
SetFilterType(FILE_SYSTEM_MONITOR | FILE_SYSTEM_CONTROL | FILE_SYSTEM_ENCRYPTION);
SetConnectionTimeout(10);

// Register the kernel->user callback (5 worker threads)
RegisterMessageCallback(5, MyMessageCallback, MyDisconnectCallback);
```

--------------------------------

### Manual Installation of EaseFilter

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Manually install the EaseFilter Python library by installing dependencies and running the CLI or Python REPL. Administrator permissions are required.

```bash
pip install -r requirements.txt
```

```bash
python -m easefilter.cli [args]
```

```bash
python
```

--------------------------------

### Install EaseFilter CLI with Hatch

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Use Hatch to install the EaseFilter Python library and run its command-line interface. Ensure Python 3.9+ is installed and a license key is configured in config.toml.

```bash
pip install hatch
```

```bash
hatch run cli [args]
```

```bash
hatch run py
```

--------------------------------

### Start Filter Service (C#)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Starts the EaseFilter service, combining various filter types. Requires a license key. Ensure to call StopFilter() for graceful shutdown.

```csharp
using EaseFilter.FilterControl;

string lastError = string.Empty;
string licenseKey = "your-license-key";

FilterControl filterControl = new FilterControl();

// Combine filter types as needed
FilterAPI.FilterType filterType =
    FilterAPI.FilterType.MONITOR_FILTER |
    FilterAPI.FilterType.CONTROL_FILTER |
    FilterAPI.FilterType.ENCRYPTION_FILTER |
    FilterAPI.FilterType.PROCESS_FILTER |
    FilterAPI.FilterType.REGISTRY_FILTER;

int serviceThreads    = 5;   // worker threads waiting for kernel callbacks
int connectionTimeout = 10;  // seconds before callback times out

if (!filterControl.StartFilter(filterType, serviceThreads, connectionTimeout, licenseKey, ref lastError))
{
    Console.WriteLine("Failed to start filter: " + lastError);
    return;
}

// --- Later: graceful shutdown ---
filterControl.StopFilter();
```

--------------------------------

### Install Filter Driver

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Installs the EaseFilter file system filter driver. Requires administrator privileges.

```c
InstallDriver()
```

--------------------------------

### Compile Demo CLI with Maven

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Use Maven to package the demo CLI application. Ensure Java and Maven are installed and the configuration file is updated with a license key.

```bash
mvn package
```

--------------------------------

### Block File Access from Network Computers

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Protect files by blocking access originating from network computers. This example applies the protection to files in 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS&(~ALLOW_FILE_ACCESS_FROM_NETWORK), L"c:\\test\\*", 1);

```

--------------------------------

### Driver Management

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Functions to install, uninstall, and manage the EaseFilter driver.

```APIDOC
## Driver Management

### Install Driver
Installs the EaseFilter driver. Requires administrator privileges.

```c
InstallDriver();
```

### Uninstall Driver
Uninstalls the EaseFilter driver. Requires administrator privileges.

```c
UnInstallDriver();
```
```

--------------------------------

### Register I/O Callbacks for File Operations

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Register specific I/O callbacks (e.g., PRE_CREATE, PRE_SETINFORMATION) for a directory to allow or deny file operations within a callback routine. This example targets 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
RegisterControlToFilterRule(L"c:\\test\\*",PRE_CREATE|PRE_SET_INFORMATION);

```

--------------------------------

### Authorize or De-authorize File Access Rights for Processes

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Set specific file access rights for processes. This example grants full access to 'notepad.exe', read-only access to 'wordpad.exe', and revokes all rights from others for files in 'c:\test\'.

```c
AddFileFilterRule(LEAST_ACCESS_FLAG, L"c:\\test\\*", 1);
AddProcessRightsToFilterRule(L"c:\\test\\*",L"notepad.exe",ALLOW_MAX_RIGHT_ACCESS);
AddProcessRightsToFilterRule(L"c:\\test\\*",L"wordpad.exe",ALLOW_MAX_RIGHT_ACCESS&(~(ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS|ALLOW_WRITE_ACCESS|ALLOW_FILE_RENAME|ALLOW_FILE_DELETE|ALLOW_SET_INFORMATION)));
```

--------------------------------

### Block New File Creation

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Configure access control flags to prevent new file creation within a specified directory. This example blocks creation in 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS&(~ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS), L"c:\\test\\*", 1);

```

--------------------------------

### Restrict File Access Rights for Specific Processes

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Sets specific file access rights for a given process on a folder. This example demonstrates setting read-only access for 'notepad.exe' on 'c:\windows\*' and full access on 'c:\test\*'.

```c++
AddFileControlToProcessByName(wcslen(L"notepad.exe")*2, L"notepad.exe", wcslen(L"c:\\windows\\*")*2,L"c:\\windows\\*"
,ALLOW_MAX_RIGHT_ACCESS&(~(ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS|ALLOW_WRITE_ACCESS|ALLOW_FILE_RENAME|ALLOW_FILE_DELETE|ALLOW_SET_INFORMATION)));
```

```c++
AddFileControlToProcessByName(wcslen(L"notepad.exe")*2, L"notepad.exe", wcslen(L"c:\\test\\*")*2,L"c:\\test\*",ALLOW_MAX_RIGHT_ACCESS );
```

--------------------------------

### Set Registration Key

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Sets the registration key for the EaseFilter driver. This is a required step before starting the driver.

```c
SetRegistrationKey(WCHAR* RegisterKey);
```

--------------------------------

### Encrypt Directory

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Transparently encrypt all files within a specified directory. A password will be prompted for during setup. Files will be unreadable when the filter is stopped.

```bash
.\ef-demo encrypt C:\path\to\directory\*
```

--------------------------------

### Monitor File I/O Events (C++)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Registers a file filter rule and specifies the types of I/O events to monitor. This C++ example demonstrates how to capture specific file operations like creation, read, and write.

```cpp
// C++ — monitor specific I/Os with RegisterMonitorToFilterRule
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\watchfolder\\*", FALSE, 10);
RegisterEventTypeToFilterRule(
    L"c:\\watchfolder\\*",
    FILE_WAS_WRITTEN | FILE_WAS_RENAMED | FILE_WAS_DELETED | FILE_WAS_CREATED
);
RegisterMonitorToFilterRule(
    L"c:\\watchfolder\\*",
    POST_CREATE | POST_FASTIO_READ | POST_CACHE_READ | POST_NOCACHE_READ
);
```

--------------------------------

### Add Register IO Filter to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Register I/O operations for filtering based on file open options. This example registers a PRE_CREATE callback for DELETE access.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
RegisterControlToFilterRule(L"c:\\test\\*",PRE_CREATE);
AddRegisterIOFilterToFilterRule(L"c:\\test\\*",DELETE,0,0);
```

--------------------------------

### Prevent cmd.exe from Starting

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Deny the execution of cmd.exe. Use with caution as this prevents a common system utility from running.

```bash
.\ef-demo process --deny C:\Windows\System32\cmd.exe
```

--------------------------------

### Reparse File Opens to Another Location

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Redirect file open requests from one location to another. This example reroutes opens in 'c:\test\' to 'c:\reparseFolder\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS|REPARSE_FILE_OPEN, L"c:\\test\\*", 1);
AddReparseFileMaskToFilterRule(L"c:\\test\\*",L"c:\\reparseFolder\\*");

```

--------------------------------

### Transparent File Encryption

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Enable automatic encryption and decryption of files in memory, ensuring files remain encrypted on disk. This example uses AES 256-bit encryption for files in 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS|FILE_ENCRYPTION_RULE, L"c:\\test\\*", 1);

//256 bit,32bytes encrytpion key
unsigned char key[] = {0x60,0x3d,0xeb,0x10,0x15,0xca,0x71,0xbe,0x2b,0x73,0xae,0xf0,0x85,0x7d,0x77,0x81,0x1f,0x35,0x2c,0x07,0x3b,0x61,0x08,0xd7,0x2d,0x98,0x10,0xa3,0x09,0x14,0xdf,0xf4};
AddEncryptionKeyToFilterRule(L"c:\\test\\*",sizeof(key),key);

```

--------------------------------

### Add Include Process Name to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to apply a filter rule only to specific processes. For example, to manage I/Os in c:\test only for notepad.exe.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
AddIncludeProcessNameToFilterRule(L"c:\\test\\*",L"notepad.exe");
```

--------------------------------

### Get All Registry Operation Notifications for a Process

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Registers to receive all types of notifications for registry operations performed by a specific process (e.g., 'notepad.exe'). This is useful for auditing or monitoring registry access.

```c++
AddRegistryFilterRuleByProcessName(wcslen(L"notepad.exe")*2, L"notepad.exe",REG_MAX_ACCESS_FLAG,MAX_REG_CALLBACK_CLASS,0 );
```

--------------------------------

### Hide Sensitive Files from Specific Processes

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Hide files in a directory from specific processes and configure the mask for hidden files. This example hides files in 'c:\test\' from 'explorer.exe'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS|HIDE_FILES_IN_DIRECTORY_BROWSING, L"c:\\test\\*", 1);
AddIncludeProcessNameToFilterRule(L"c:\\test\\*",L"explorer.exe");
AddHiddenFileMaskToFilterRule(L"c:\\test\\*",L"*.* উত্ত");

```

--------------------------------

### Register Event Type to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Register specific file event types to track for files within a given filter mask. This example tracks file written, renamed, and deleted events.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
RegisterEventTypeToFilterRule(L"c:\\test\\*",FILE_WAS_WRITTEN|FILE_WAS_RENAMED|FILE_WAS_DELETED);
```

--------------------------------

### Run Demo CLI

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Execute the compiled demo CLI application. Use the --help flag for general assistance or specific subcommands for detailed help.

```bash
.\ef-demo --help
```

```bash
.\ef-demo monitor --help
```

--------------------------------

### View Registry Permissions Help

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Display a list of available permissions that can be managed for registry operations using the EaseFilter demo CLI.

```bash
.\ef-demo registry --block-perms=HELP
```

--------------------------------

### Driver Initialization

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Functions to initialize and configure the EaseFilter driver.

```APIDOC
## Driver Initialization

### Set Registration Key
Sets the registration key for the EaseFilter driver.

**Parameters:**
- **RegisterKey** (WCHAR*) - The registration key string.

```c
SetRegistrationKey(WCHAR* RegisterKey);
```

### Register Message Callback
Registers callback functions for driver messages and disconnections.

**Parameters:**
- **ThreadCount** (ULONG) - The number of worker threads.
- **MessageCallback** (Proto_Message_Callback) - Callback function for messages.
- **DisconnectCallback** (Proto_Disconnect_Callback) - Callback function for disconnections.

```c
RegisterMessageCallback(ULONG ThreadCount, Proto_Message_Callback MessageCallback, Proto_Disconnect_Callback DisconnectCallback);
```
```

--------------------------------

### Prevent File Modification, Renaming, or Deletion

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

This configuration prevents sensitive files in the specified directory from being modified, renamed, or deleted. The example applies to 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS&(~(ALLOW_WRITE_ACCESS|ALLOW_FILE_RENAME|ALLOW_FILE_DELETE), L"c:\\test\\*", 1);

```

--------------------------------

### Format Code with Hatch

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Run this command to format and lint your code using Ruff and Pyright. Use --check for a dry-run without making changes.

```bash
hatch fmt
```

```bash
hatch fmt --check
```

--------------------------------

### Prevent Sensitive Files from Being Copied Out

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this rule to prevent files within a protected folder from being copied to external locations. The example targets 'c:\test\'.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS&(~ALLOW_COPY_PROTECTED_FILES_OUT), L"c:\\test\\*", 1);
     
```

--------------------------------

### Monitor Registry Events by Key Name

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor registry events for keys that match a specific name pattern. Use wildcards like '*' to match parts of the key name.

```bash
.\ef-demo registry *KeyName*
```

--------------------------------

### Monitor File Change Events (C#)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Sets up real-time file change event monitoring for a specified directory. This includes subscribing to various file lifecycle events and I/O operations, with options to include data buffers in callbacks.

```csharp
using EaseFilter.FilterControl;

FilterControl filterControl = new FilterControl();
filterControl.StartFilter(FilterAPI.FilterType.MONITOR_FILTER, 5, 10, licenseKey, ref lastError);

FileFilter monitorRule = new FileFilter(@"c:\watchfolder\*");

// Subscribe to file-changed lifecycle events
monitorRule.FileChangeEventFilter =
    FilterAPI.FileChangedEvents.NotifyFileWasCreated  |
    FilterAPI.FileChangedEvents.NotifyFileWasWritten  |
    FilterAPI.FileChangedEvents.NotifyFileWasDeleted  |
    FilterAPI.FileChangedEvents.NotifyFileWasRenamed  |
    FilterAPI.FileChangedEvents.NotifyFileWasCopied;

monitorRule.NotifyFileWasChanged += (sender, e) =>
{
    Console.WriteLine($"[{e.eventType}] {e.FileName} | User: {e.UserName} | Process: {e.ProcessName}");
    // Expected output:
    // [NotifyFileWasWritten] c:\watchfolder\report.docx | User: DOMAIN\alice | Process: WINWORD.EXE
};

// Subscribe to real-time I/O request callbacks
monitorRule.MonitorFileIOEventFilter =
    MonitorFileIOEvents.OnFileCreate |
    MonitorFileIOEvents.OnFileRead   |
    MonitorFileIOEvents.OnFileWrite;

monitorRule.EnableSendReadOrWriteBuffer = true; // include data buffer in callback

monitorRule.OnFileOpen  += (s, e) => Console.WriteLine($"OPEN  {e.FileName} pid={{e.ProcessId}} access=0x{{e.DesiredAccess:X}}");
monitorRule.OnFileRead  += (s, e) => Console.WriteLine($"READ  {e.FileName} offset={{e.Offset}} len={{e.Length}}");
monitorRule.OnFileWrite += (s, e) => Console.WriteLine($"WRITE {e.FileName} offset={{e.Offset}} len={{e.Length}}");

filterControl.AddFilter(monitorRule);
filterControl.SendConfigSettingsToFilter(ref lastError);
```

--------------------------------

### Add Include User Name to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to apply a filter rule only to specific users. For example, to manage I/Os in c:\test only for the user TestDoman\TestUser.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
AddIncludeUserNameToFilterRule(L"c:\\test\\*",L"TestDoman\\TestUser");
```

--------------------------------

### C# - Intercept PRE_CREATE and PRE_WRITE, block writes from untrusted processes

Source: https://context7.com/easefilter/filterdriver/llms.txt

This C# snippet demonstrates how to register pre-operation callbacks for file creation and write events. It shows how to block file creation from specific untrusted paths and logs write operations. Ensure the FileFilter and FilterAPI are correctly initialized.

```csharp
// C# — intercept PRE_CREATE and PRE_WRITE; block writes from untrusted processes
FileFilter controlRule = new FileFilter(@"c:\confidential\*");
controlRule.AccessFlag = FilterAPI.ALLOW_MAX_RIGHT_ACCESS;

// Register PRE callbacks for create and write
controlRule.ControlFileIOEventFilter =
    ControlFileIOEvents.OnPreFileCreate |
    ControlFileIOEvents.OnPreFileWrite;

controlRule.OnPreFileCreate += (sender, e) =>
{
    // Block creation from untrusted paths
    if (e.ProcessName.StartsWith(@"C:\Downloads\", StringComparison.OrdinalIgnoreCase))
    {
        e.ReturnStatus = NtStatus.Status.AccessDenied;
        Console.WriteLine($"Blocked create from untrusted process: {e.ProcessName}");
    }
};

controlRule.OnPreFileWrite += (sender, e) =>
{
    Console.WriteLine($"PRE_WRITE {e.FileName} by {e.ProcessName}, {e.Length} bytes @ offset {e.Offset}");
    // Allow by default; set e.ReturnStatus = NtStatus.Status.AccessDenied to block
};

filterControl.AddFilter(controlRule);
filterControl.SendConfigSettingsToFilter(ref lastError);
```

--------------------------------

### Monitor Process and Thread Events (C++)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Register rules to receive notifications for process and thread creation/termination. Use DENY_NEW_PROCESS_CREATION to block process execution and ENABLE_SEND_PROCESS_DENIED_EVENT to receive an event when a process is denied.

```cpp
// C++ — monitor all process and thread creation/termination
AddProcessFilterRule(
    wcslen(L"*") * 2, L"*",
    PROCESS_CREATION_NOTIFICATION    |
    PROCESS_TERMINATION_NOTIFICATION |
    THREAD_CREATION_NOTIFICATION     |
    THREAD_TERMINATION_NOTIFICATION,
    40
);

// Block execution of anything under c:\untrusted\
AddProcessFilterRule(
    wcslen(L"c:\untrusted\*") * 2, L"c:\untrusted\*",
    DENY_NEW_PROCESS_CREATION | ENABLE_SEND_PROCESS_DENIED_EVENT,
    41
);

// Protect a critical service process from termination
ULONG myServicePid = GetCurrentProcessId();
AddProtectedProcessId(myServicePid);

// Restrict notepad.exe: read-only on c:\windows\*, full access on c:\work
AddFileControlToProcessByName(
    wcslen(L"notepad.exe") * 2, L"notepad.exe",
    wcslen(L"c:\windows\*") * 2, L"c:\windows\*",
    ALLOW_MAX_RIGHT_ACCESS & (~(ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS |
                                ALLOW_WRITE_ACCESS | ALLOW_FILE_RENAME |
                                ALLOW_FILE_DELETE  | ALLOW_SET_INFORMATION))
);
AddFileControlToProcessByName(
    wcslen(L"notepad.exe") * 2, L"notepad.exe",
    wcslen(L"c:\work\*") * 2, L"c:\work\*",
    ALLOW_MAX_RIGHT_ACCESS
);
```

--------------------------------

### Configure Drop Folder for Encrypted File Access

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Sets up a 'drop folder' (e.g., c:\dropFolder) where processes can read encrypted files. It disables the automatic new file encryption feature for this folder.

```c++
AddFileFilterRule((ALLOW_MAX_RIGHT_ACCESS|FILE_ENCRYPTION_RULE)&(~ALLOW_ENCRYPT_NEW_FILES), L"c:\\dropFolder\\*", 1);
```

```c++
//256 bit,32bytes encrytpion key
unsigned char key[] = {0x60,0x3d,0xeb,0x10,0x15,0xca,0x71,0xbe,0x2b,0x73,0xae,0xf0,0x85,0x7d,0x77,0x81,0x1f,0x35,0x2c,0x07,0x3b,0x61,0x08,0xd7,0x2d,0x98,0x10,0xa3,0x09,0x14,0xdf,0xf4};
AddEncryptionKeyToFilterRule(L"c:\\dropFolder\\*",sizeof(key),key);
```

--------------------------------

### Add Exclude Process Name to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to apply a filter rule except for specific processes. For example, to manage I/Os in c:\test except for notepad.exe.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
AddExcludeProcessNameToFilterRule(L"c:\\test\\*",L"notepad.exe");
```

--------------------------------

### Add Exclude User Name to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to apply a filter rule except for specific users. For example, to manage I/Os in c:\test except for the user TestDoman\TestUser.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
AddExcludeUserNameToFilterRule(L"c:\\test\\*",L"TestDoman\\TestUser");
```

--------------------------------

### Configure Transparent File Encryption with Whitelist

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Automatically encrypts files in a specified folder using AES 256-bit key. Only authorized processes (e.g., notepad.exe) can read decrypted files. Other processes will access encrypted data. New files are encrypted automatically.

```c++
AddFileFilterRule((ALLOW_MAX_RIGHT_ACCESS|FILE_ENCRYPTION_RULE)&(~ALLOW_READ_ENCRYPTED_FILES), L"c:\\test\\*", 1);
```

```c++
//256 bit,32bytes encrytpion key
unsigned char key[] = {0x60,0x3d,0xeb,0x10,0x15,0xca,0x71,0xbe,0x2b,0x73,0xae,0xf0,0x85,0x7d,0x77,0x81,0x1f,0x35,0x2c,0x07,0x3b,0x61,0x08,0xd7,0x2d,0x98,0x10,0xa3,0x09,0x14,0xdf,0xf4};
AddEncryptionKeyToFilterRule(L"c:\\test\\*",sizeof(key),key);
```

```c++
AddProcessRightsToFilterRule(L"c:\\test\\*",L"notepad.exe",ALLOW_MAX_RIGHT_ACCESS);
```

--------------------------------

### Add Exclude File Mask to Filter Rule

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to exclude specific file types from a filter rule. For example, to manage I/Os in c:\test but exclude all .txt files.

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
AddExcludeFileMaskToFilterRule(L"c:\\test\\*",L"*.txt");
```

--------------------------------

### Create and Manage Stub Files with Tag Data

Source: https://context7.com/easefilter/filterdriver/llms.txt

Use CreateStubFileEx to create placeholder files with virtual sizes and embedded tag data. Retrieve and update tag data using GetTagData and AddTagData. Open stub files directly with OpenStubFile.

```cpp
// C++ — create a stub file representing a 1 GB cloud-resident file
HANDLE hFile = INVALID_HANDLE_VALUE;
BYTE   tagData[] = { /* custom cloud reference metadata, e.g. object key */ };

BOOL ok = CreateStubFileEx(
    L"c:\\cloudtier\\bigfile.dat",
    1024LL * 1024 * 1024,  // virtual file size: 1 GB
    FILE_ATTRIBUTE_REPARSE_POINT,
    sizeof(tagData), tagData,
    0, 0, 0,               // timestamps (0 = use current time)
    TRUE,                  // overwrite if exists
    &hFile
);

if (ok)
{
    // Retrieve the tag data back from the stub
    ULONG readLen = sizeof(tagData);
    BYTE  readTag[256] = {};
    GetTagData(hFile, &readLen, readTag);

    // Update the tag (e.g. after partial rehydration)
    BYTE updatedTag[] = { /* new metadata */ };
    AddTagData(hFile, sizeof(updatedTag), updatedTag);

    CloseHandle(hFile);
}

// Open a stub file bypassing the recall mechanism
HANDLE hStub = INVALID_HANDLE_VALUE;
OpenStubFile(L"c:\\cloudtier\\bigfile.dat", GENERIC_READ, FILE_SHARE_READ, &hStub);
CloseHandle(hStub);
```

--------------------------------

### Monitor All Process Events

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor all process creation and deletion events. This is useful for tracking running applications.

```bash
.\ef-demo process *
```

--------------------------------

### Monitor Process and Thread Events (C#)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Configure a ProcessFilter object to watch all processes and define callbacks for process creation and termination events. Use e.ReturnStatus = NtStatus.Status.AccessDenied in the creation callback to block a process.

```csharp
// C# — process filter with event callbacks
ProcessFilter procFilter = new ProcessFilter();
procFilter.ProcessFilterMask = "*";  // watch all processes
procFilter.ControlFlag =
    FilterAPI.ProcessControlFlag.PROCESS_CREATION_NOTIFICATION |
    FilterAPI.ProcessControlFlag.PROCESS_TERMINATION_NOTIFICATION;

procFilter.OnProcessCreation += (sender, e) =>
{
    Console.WriteLine($"CREATED  PID={e.ProcessId}  parent={e.ParentProcessId}  cmd={e.CommandLine}");
    // To block: e.ReturnStatus = NtStatus.Status.AccessDenied;
};

procFilter.OnProcessTermination += (sender, e) =>
    Console.WriteLine($"TERMINATED PID={e.ProcessId}");

filterControl.AddFilter(procFilter);
filterControl.SendConfigSettingsToFilter(ref lastError);
```

--------------------------------

### Encrypt Directory with Process Restriction

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Encrypt a directory and restrict decryption access to a specific process, such as notepad.exe. This enhances security by limiting who can decrypt the files.

```bash
.\ef-demo encrypt --allow-proc notepad.exe C:\path\to\directory\*
```

--------------------------------

### C++ - Block file creation and control access rights

Source: https://context7.com/easefilter/filterdriver/llms.txt

This C++ snippet shows how to block file creation in specific directories and control access rights. It uses functions like AddFileFilterRule and RegisterControlToFilterRule to define filtering policies. Note the use of bitwise operations to modify access flags.

```cpp
// C++ — block file creation in c:\test, allow only DELETE-open callbacks
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\test\*", FALSE, 20);
RegisterControlToFilterRule(L"c:\test\*", PRE_CREATE);
AddRegisterIOFilterToFilterRule(L"c:\test\*", DELETE, 0, 0); // only fire when DELETE access

// Block new file creation globally
AddFileFilterRule(
    ALLOW_MAX_RIGHT_ACCESS & (~ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS),
    L"c:\readonly\*", FALSE, 21
);

// Block copy-out of protected folder
AddFileFilterRule(
    ALLOW_MAX_RIGHT_ACCESS & (~ALLOW_COPY_PROTECTED_FILES_TO_USB),
    L"c:\nousb\*", FALSE, 22
);

// Block network access to a folder
AddFileFilterRule(
    ALLOW_MAX_RIGHT_ACCESS & (~ALLOW_FILE_ACCESS_FROM_NETWORK),
    L"c:\local-only\*", FALSE, 23
);
```

--------------------------------

### Monitor All Filesystem Events

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor all file system events across the entire system. This command is useful for observing all file operations.

```bash
.\ef-demo monitor *
```

--------------------------------

### C# DRM Mode Encryption with Service Callback

Source: https://context7.com/easefilter/filterdriver/llms.txt

Implements Digital Rights Management (DRM) by using a user-mode service callback to supply per-file keys and Initialization Vectors (IVs). This allows for dynamic authorization of processes based on retrieved file metadata.

```csharp
// C# — DRM mode: per-file key and IV supplied by a user-mode service callback
FileFilter drmFilter = new FileFilter(@"c:\drm\*");
drmFilter.EnableEncryption = true;
drmFilter.EnableEncryptionKeyFromService = true;

drmFilter.OnFilterRequestEncryptKey += (sender, e) =>
{
    if (e.IsNewCreatedFile)
    {
        // Generate a unique IV per file; store it in the embedded tag
        byte[] iv = Guid.NewGuid().ToByteArray();
        e.IV  = iv;
        e.EncryptionTag = iv;                                        // persisted in file header
        e.EncryptionKey = Utils.GetKeyByPassPhrase("PerFileKey", 32);
        e.ReturnStatus  = NtStatus.Status.Success;
        Console.WriteLine($"Encrypting new file: {e.FileName}  process: {e.ProcessName}");
    }
    else
    {
        // Retrieve the IV from the tag embedded in the encrypted file header
        byte[] storedIV = e.EncryptionTag;
        e.IV  = storedIV;
        e.EncryptionKey = Utils.GetKeyByPassPhrase("PerFileKey", 32);

        bool authorized = new[] { "notepad.exe", "myapp.exe" }.Contains(e.ProcessName);
        e.ReturnStatus  = authorized
            ? NtStatus.Status.Success       // return decrypted data
            : NtStatus.Status.FileIsEncrypted; // return raw ciphertext
    }
};

filterControl.AddFilter(drmFilter);
filterControl.SendConfigSettingsToFilter(ref lastError);
```

--------------------------------

### C# Auto-Encrypt Files with Whitelisted Processes

Source: https://context7.com/easefilter/filterdriver/llms.txt

Encrypts files in a specified directory automatically. Only whitelisted processes can view the decrypted content; others see ciphertext. Requires setting up a FileFilter instance and configuring encryption keys and trusted processes.

```csharp
// C# — auto-encrypt c:\vault\* ; only notepad.exe and wordpad.exe see plaintext
FileFilter encFilter = new FileFilter(@"c:\vault\*");
encFilter.EnableEncryption = true;

// Derive a 256-bit key from a passphrase
encFilter.EncryptionKey = Utils.GetKeyByPassPhrase("MyS3cretPassphrase!", 32);

// Default: deny decrypted reads to all processes
encFilter.EnableReadEncryptedData = false;

// Whitelist specific processes
encFilter.AddTrustedProcessRight(FilterAPI.ALLOW_MAX_RIGHT_ACCESS, "notepad.exe",  "", "");
encFilter.AddTrustedProcessRight(FilterAPI.ALLOW_MAX_RIGHT_ACCESS, "wordpad.exe", "", "");

filterControl.AddFilter(encFilter);
filterControl.SendConfigSettingsToFilter(ref lastError);
// All files written to c:\vault\ are now AES-256 encrypted on disk.
// notepad.exe / wordpad.exe read plaintext; all others read ciphertext.
```

--------------------------------

### Monitor File System Events

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Monitor file and folder access events. Use '*' to monitor all files on a device or specify a directory path. The --io-mask flag can be used to monitor specific event types.

```bash
hatch run cli monitor
```

```bash
hatch run cli monitor *
```

```bash
hatch run cli monitor "C:\directory\*"
```

```bash
hatch run cli monitor --io-mask 192118399729052330
```

```bash
hatch run cli monitor --io-sym POST_CREATE
```

--------------------------------

### Assign Per-Process and Per-User Access Rights

Source: https://context7.com/easefilter/filterdriver/llms.txt

Configure fine-grained access control for specific processes or users on file filter rules. Deny all by default and grant specific rights, optionally verifying process identity via SHA-256 hash.

```cpp
// C++ — zero-trust model: deny all by default, grant per process/user
AddFileFilterRule(LEAST_ACCESS_FLAG, L"c:\\sensitive\\*", FALSE, 60);

// notepad.exe: full access (verified by SHA-256 hash)
CHAR sha256[] = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
AddProcessRightsToFilterRule(
    L"c:\\sensitive\\*",
    L"notepad.exe",
    ALLOW_MAX_RIGHT_ACCESS,
    NULL,       // certificate name (NULL = skip check)
    sha256      // image SHA-256 (NULL = skip check)
);

// wordpad.exe: read-only, no rename/delete
AddProcessRightsToFilterRule(
    L"c:\\sensitive\\*", L"wordpad.exe",
    ALLOW_MAX_RIGHT_ACCESS &
        (~(ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS |
           ALLOW_WRITE_ACCESS | ALLOW_FILE_RENAME | ALLOW_FILE_DELETE))
);

// Domain user: read + directory list only
AddUserRightsToFilterRule(
    L"c:\\sensitive\\*",
    L"CORP\\john.doe",
    ALLOW_OPEN_WITH_READ_ACCESS | ALLOW_READ_ACCESS | ALLOW_DIRECTORY_LIST_ACCESS
);

// Exclude a trusted backup process from all rules globally
AddExcludedProcessId(backupProcessId);
```

--------------------------------

### Set Registry Read-Only Access for a Process

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Configures read-only access rights for a specific process (e.g., 'notepad.exe') to registry keys. This prevents unauthorized modifications to critical registry settings.

```c++
AddRegistryFilterRuleByProcessName(wcslen(L"notepad.exe")*2, L"notepad.exe",ALLOW_READ_REGITRY_ACCESS_FLAG,0,0 );
```

--------------------------------

### Register I/O Operations for File Monitoring

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Use this to register specific I/O operations for monitoring on a given file path. Ensure the FilterMask and RegisterIO values are correctly set.

```c
typedef enum  MessageType
{
	POST_CREATE 		= 0x00000002,	
	POST_FASTIO_READ 		= 0x00000008,	
	POST_CACHE_READ 		= 0x00000020,
	POST_NOCACHE_READ 		= 0x00000080,
	POST_PAGING_IO_READ 		= 0x00000200,
	POST_FASTIO_WRITE 		= 0x00000800,
	POST_CACHE_WRITE 		= 0x00002000,
	POST_NOCACHE_WRITE 		= 0x00008000,
	POST_PAGING_IO_WRITE 		= 0x00020000,
	POST_QUERY_INFORMATION 		= 0x00080000,
	POST_SET_INFORMATION 		= 0x00200000,
	POST_DIRECTORY 		= 0x00800000,
	POST_QUERY_SECURITY 		= 0x02000000,
	POST_SET_SECURITY 		= 0x08000000,
	POST_CLEANUP 		= 0x20000000,
	POST_CLOSE 		= 0x80000000,

};


		
RegisterMonitorToFilterRule(WCHAR* FilterMask,ULONG  RegisterIO);

```

```c
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\test\\*", 1);
RegisterMonitorToFilterRule(L"c:\\test\\*",POST_CREATE|POST_FASTIO_READ|POST_CACHE_READ|POST_NOCACHE_READ|POST_PAGING_IO_READ);
     
```

--------------------------------

### Monitor Processes in System32 Directory

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor process events for all executables located within the C:\Windows\System32 directory.

```bash
.\ef-demo process C:\Windows\System32\*
```

--------------------------------

### Monitor Process Events

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Monitor process creation and deletion events. You can monitor all processes, specific executables using --proc-mask, or control process creation.

```bash
hatch run cli process
```

```bash
hatch run cli process --proc-mask C:\Windows\System32\cmd.exe
```

```bash
hatch run cli process --proc-mask C:\Windows\System32\*
```

```bash
hatch run cli process --proc-control-sym DENY_NEW_PROCESS_CREATION --proc-mask C:\Windows\System32\cmd.exe
```

--------------------------------

### Monitor Events in a Specific Directory

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor all file system events within a specified directory. Replace 'C:\path\to\directory' with the actual directory path.

```bash
.\ef-demo monitor C:\path\to\directory\*
```

--------------------------------

### Register File Filter Rule with Custom Access Rights (C++)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Registers a path-based rule with a specific access flag bitmask. Use this to define granular permissions for file operations. The rule is not loaded at boot time and is assigned a unique filter rule ID.

```cpp
// C++ — Full access to c:\protected\* except write/delete/rename
AddFileFilterRule(
    ALLOW_MAX_RIGHT_ACCESS & (~(ALLOW_WRITE_ACCESS | ALLOW_FILE_DELETE | ALLOW_FILE_RENAME)),
    L"c:\\protected\\*",
    FALSE,   // not resident (not loaded at boot time)
    1        // filter rule ID shown in callbacks
);

// Allow only notepad.exe to access c:\sensitive\*; deny everything else
AddFileFilterRule(LEAST_ACCESS_FLAG, L"c:\\sensitive\\*", FALSE, 2);
AddProcessRightsToFilterRule(L"c:\\sensitive\\*", L"notepad.exe", ALLOW_MAX_RIGHT_ACCESS);

// Exclude *.log files from the rule entirely
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS, L"c:\\data\\*", FALSE, 3);
AddExcludeFileMaskToFilterRule(L"c:\\data\\*", L"*.log");

// Reparse opens of c:\virtual\*.txt to c:\real\*.txt
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS | ENABLE_REPARSE_FILE_OPEN, L"c:\\virtual\\*.txt", FALSE, 4);
AddReparseFileMaskToFilterRule(L"c:\\virtual\\*.txt", L"c:\\real\\*.txt");

// Hide all *.secret files from Explorer
AddFileFilterRule(ALLOW_MAX_RIGHT_ACCESS | ENABLE_HIDE_FILES_IN_DIRECTORY_BROWSING, L"c:\\vault\\*", FALSE, 5);
AddIncludeProcessNameToFilterRule(L"c:\\vault\\*", L"explorer.exe");
AddHiddenFileMaskToFilterRule(L"c:\\vault\\*", L"*.secret");
```

--------------------------------

### Configure Volume Control Flags

Source: https://context7.com/easefilter/filterdriver/llms.txt

Set volume-level policies such as blocking writes to USB drives or preventing volume dismount. Handle volume attachment notifications and configure specific media types like SD cards.

```cpp
// C++ — block all writes to USB drives; prevent volume dismount
SetVolumeControlFlag(
    BLOCK_USB_WRITE         |  // block all writes to USB/removable media
    BLOCK_VOLUME_DISMOUNT   |  // prevent accidental volume unmount
    VOLUME_ATTACHED_NOTIFICATION  // get callbacks when volumes attach/detach
);

// In the message callback, handle volume events:
// if (pSendMessage->FilterCommand == FILTER_SEND_ATTACHED_VOLUME_INFO)
//     printf("Volume attached: %ws\n", pSendMessage->DataBuffer.VolumeData.VolumeInfo.VolumeDosName);

// Allow removable media that is NOT a USB disk (e.g. SD card reader)
SetBooleanConfig(DISABLE_REMOVABLE_MEDIA_AS_USB);
```

--------------------------------

### File Encryption Rules

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Configure rules for transparently encrypting files in a folder, specifying which users or processes can access decrypted data and setting encryption keys.

```APIDOC
## AddFileFilterRule

### Description
Configures file filter rules, including encryption settings and access rights.

### Method
AddFileFilterRule

### Parameters
- **ruleFlags** (int) - Flags specifying the rule behavior (e.g., ALLOW_MAX_RIGHT_ACCESS, FILE_ENCRYPTION_RULE, ALLOW_READ_ENCRYPTED_FILES).
- **filePath** (L"") - Path to the file or folder to apply the rule to.
- **options** (int) - Additional options for the rule.

### Request Example
```c
AddFileFilterRule((ALLOW_MAX_RIGHT_ACCESS|FILE_ENCRYPTION_RULE)&(~ALLOW_READ_ENCRYPTED_FILES), L"c:\\test\\*", 1);
```

## AddEncryptionKeyToFilterRule

### Description
Adds an encryption key to a filter rule for a specified file path.

### Method
AddEncryptionKeyToFilterRule

### Parameters
- **filePath** (L"") - Path to the file or folder associated with the encryption key.
- **keySize** (int) - Size of the encryption key in bytes.
- **key** (unsigned char[]) - The encryption key.

### Request Example
```c
unsigned char key[] = {0x60,0x3d,0xeb,0x10,0x15,0xca,0x71,0xbe,0x2b,0x73,0xae,0xf0,0x85,0x7d,0x77,0x81,0x1f,0x35,0x2c,0x07,0x3b,0x61,0x08,0xd7,0x2d,0x98,0x10,0xa3,0x09,0x14,0xdf,0xf4};
AddEncryptionKeyToFilterRule(L"c:\\test\\*",sizeof(key),key);
```

## AddProcessRightsToFilterRule

### Description
Assigns specific access rights to a process for a given file path.

### Method
AddProcessRightsToFilterRule

### Parameters
- **filePath** (L"") - Path to the file or folder.
- **processName** (L"") - Name of the process.
- **rights** (int) - Access rights to grant to the process.

### Request Example
```c
AddProcessRightsToFilterRule(L"c:\\test\\*",L"notepad.exe",ALLOW_MAX_RIGHT_ACCESS);
```
```

--------------------------------

### Register for Process and Thread Notifications

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Registers to receive notifications for process and thread creation, termination, and other handle operations. This is useful for monitoring system activity.

```c++
AddProcessFilterRule(2, L"*", PROCESS_CREATION_NOTIFICATION|PROCESS_TERMINATION_NOTIFICATION|THREAD_CREATION_NOTIFICATION|THREAD_TERMINATION_NOTIFICATION,0);
```

--------------------------------

### Run Tests with Pytest

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/PythonDemo/README.md

Execute all project tests using pytest. Specify a test file path to run a specific test.

```bash
hatch test
```

```bash
hatch test tests/test_something.py
```

--------------------------------

### Monitor Events on C Drive

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor all file system events specifically on the C: drive. This helps in narrowing down the scope of monitoring.

```bash
.\ef-demo monitor C:\*
```

--------------------------------

### Monitor Specific Process

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor process events for a specific executable, such as cmd.exe. Provide the full path to the executable.

```bash
.\ef-demo process C:\Windows\System32\cmd.exe
```

--------------------------------

### Monitor All Registry Events

Source: https://github.com/easefilter/filterdriver/blob/master/Demo_Source_Code/JavaDemo/README.md

Monitor all events occurring in the Windows Registry. This provides a comprehensive view of registry modifications.

```bash
.\ef-demo registry *
```

--------------------------------

### C++ Offline AES File Encryption and Decryption Utilities

Source: https://context7.com/easefilter/filterdriver/llms.txt

Provides C++ functions for direct, in-place AES file encryption and decryption, as well as non-destructive encryption to a new file. It also includes utilities for encrypting in-memory buffers and retrieving AES header metadata.

```cpp
// C++ — encrypt a single file in-place with AES-256
unsigned char key[32] = { /* 32-byte key */ };

BOOL ok = AESEncryptFile(
    L"c:\\docs\\report.docx",
    sizeof(key), key,
    0, NULL,        // iv length / iv pointer (NULL = auto-generate unique IV)
    TRUE            // add AES header to file
);
if (!ok) { /* handle error */ }

// Decrypt it back
ok = AESDecryptFile(L"c:\\docs\\report.docx", sizeof(key), key);

// Encrypt source → destination (non-destructive)
ok = AESEncryptFileToFile(
    L"c:\\src\\data.bin",
    L"c:\\dst\\data.bin.enc",
    sizeof(key), key,
    0, NULL,
    TRUE
);

// Encrypt in-memory buffer
unsigned char plainBuf[4096]  = { /* data */ };
unsigned char cipherBuf[4096] = {};
AESEncryptDecryptBuffer(
    plainBuf, cipherBuf, sizeof(plainBuf),
    0,             // file offset (for IV derivation in CTR/CBC chaining)
    key, 32,
    NULL, 0        // custom IV / IV length (NULL = use default)
);

// Get AES header metadata from an encrypted file
ULONG headerSize = 512;
BYTE  header[512] = {};
GetAESHeader(L"c:\\docs\\report.docx", &headerSize, header);
```

--------------------------------

### Register File Filter Rule with Custom Access Rights (C#)

Source: https://context7.com/easefilter/filterdriver/llms.txt

Configures a file filter rule using the C# FileFilter object. This approach allows for programmatic definition of access rights and registration with the filter control.

```csharp
// C# equivalent via FileFilter object
FileFilter rule = new FileFilter(@"c:\protected\*");
rule.AccessFlag = FilterAPI.ALLOW_MAX_RIGHT_ACCESS
                  & ~(FilterAPI.ALLOW_WRITE_ACCESS | FilterAPI.ALLOW_FILE_DELETE | FilterAPI.ALLOW_FILE_RENAME);
filterControl.AddFilter(rule);
filterControl.SendConfigSettingsToFilter(ref lastError);
```

--------------------------------

### Process Filter Driver SDK

Source: https://github.com/easefilter/filterdriver/blob/master/README.md

Manage process and thread notifications, prevent untrusted binaries, protect processes from termination, and restrict file access rights for specific processes.

```APIDOC
## AddProcessFilterRule

### Description
Adds a rule to filter process and thread operations, allowing notifications or blocking actions.

### Method
AddProcessFilterRule

### Parameters
- **nameLength** (int) - Length of the process name string.
- **processName** (L"") - Name of the process or a wildcard pattern.
- **notificationClass** (int) - Flags specifying the types of notifications or actions to filter (e.g., PROCESS_CREATION_NOTIFICATION, DENY_NEW_PROCESS_CREATION).
- **options** (int) - Additional options for the rule.

### Request Example
```c
// Get notifications for process and thread creation/termination
AddProcessFilterRule(2, L"*", PROCESS_CREATION_NOTIFICATION|PROCESS_TERMINATION_NOTIFICATION|THREAD_CREATION_NOTIFICATION|THREAD_TERMINATION_NOTIFICATION,0);

// Block processes running from a specific folder
AddProcessFilterRule(wcslen(L"c:\\untrustFiles\\*")*2, L"c:\\untrustFiles\\*", DENY_NEW_PROCESS_CREATION,0);
```

## AddProtectedProcessId

### Description
Protects a process from being terminated by its process ID.

### Method
AddProtectedProcessId

### Parameters
- **processId** (int) - The ID of the process to protect.

### Request Example
```c
AddProtectedProcessId(processId);
```

## AddFileControlToProcessByName

### Description
Restricts or grants file access rights to a specific process for a given folder.

### Method
AddFileControlToProcessByName

### Parameters
- **processNameLength** (int) - Length of the process name string.
- **processName** (L"") - Name of the process.
- **filePathLength** (int) - Length of the file path string.
- **filePath** (L"") - Path to the folder.
- **rights** (int) - File access rights to set for the process.

### Request Example
```c
// Set readonly access to c:\windows for notepad.exe
AddFileControlToProcessByName(wcslen(L"notepad.exe")*2, L"notepad.exe", wcslen(L"c:\\windows\\*")*2,L"c:\\windows\\*",ALLOW_MAX_RIGHT_ACCESS&(~(ALLOW_OPEN_WITH_CREATE_OR_OVERWRITE_ACCESS|ALLOW_WRITE_ACCESS|ALLOW_FILE_RENAME|ALLOW_FILE_DELETE|ALLOW_SET_INFORMATION)));

// Set full access to c:\test for notepad.exe
AddFileControlToProcessByName(wcslen(L"notepad.exe")*2, L"notepad.exe", wcslen(L"c:\\test\\*")*2,L"c:\\test\\*",ALLOW_MAX_RIGHT_ACCESS );
```
```