[filesys/miniFilter/avscan]: app maybe bypass scans via file mapping and subsequent memory writes.

[pengyanhsha]

Which is the area where the sample lives?

/filesys/miniFilter/avscan

Describe the issue

The application performs file memory mapping, closes the opened file handle, and conducts write operations on the mapped memory area.Since the IRP_MJ_WRITE event is triggered after IRP_MJ_CLEANUP,scanning can be bypassed and relevant content may not be detected.Why not scan upon receiving the IRP_MJ_CLOSE notification also?

[v-junyli]

@microsoft/filter-manager Christian Allred (@cgallred)

[jacewq]

It seems that implementing a scan upon receiving the IRP_MJ_CLOSE notification could help ensure that any relevant data written to the memory-mapped area is still subjected to scanning. Have you considered how the potential overhead of this additional scan might impact performance, especially in high-frequency file operations?

[emmettmorin]

Because the file handle is closed before the writes to the mapped memory the IRP_MJ_WRITE comes after IRP_MJ_CLEANUP and gets bypassed. We could track memory mapping in the create path and only scan on close for those files to limit the overhead when many handles close at once.