Building the Project

This guide covers building all three components of the system: the kernel driver, the user-mode monitor, and the scanner.

Related: Getting Started · Installing the Driver

1. Build Overview

flowchart TB
    subgraph Solutions["Visual Studio Solutions"]
        DriverSln["Windows File System Minifilter.sln\n(Kernel Driver)"]
        MonitorSln["FsMinifilterMonitor.sln\n(Monitor)"]
        ScannerSln["scanner.vcxproj\n(Scanner)"]
    end

    subgraph Outputs["Build Outputs"]
        SYS["WindowsFileSystemMinifilter.sys"]
        MON["FsMinifilterMonitor.exe"]
        SCAN["scanner.exe"]
    end

    DriverSln --> SYS
    MonitorSln --> MON
    ScannerSln --> SCAN

    style Outputs fill:#2d6a4f,color:#fff

2. Project Configuration Matrix

3. Building the Kernel Driver

Prerequisites

• Windows Driver Kit (WDK) installed and integrated with Visual Studio
• WDK VSIX extension installed

Steps

1. Open Windows File System Minifilter/Windows File System Minifilter.sln
2. Select configuration:
   • Configuration: Release (recommended for deployment)
   • Platform: ARM64 or x64 (must match target machine)
3. Build → Build Solution (Ctrl+Shift+B)

Output Files

Common Build Errors

4. Building the Monitor

Steps

1. Open FsMinifilterMonitor/FsMinifilterMonitor.sln

2. Select configuration: Release

   ARM64 or x64

3. Build → Build Solution

Key Dependency

The monitor links against fltlib.lib (Filter Manager user-mode library):

#pragma comment(lib, "fltlib.lib")

This library is included with the Windows SDK.

Output

5. Building the Scanner

Steps

1. Open scanner/scanner.vcxproj (or open it within the root solution)

2. Select configuration: Release

   ARM64 or x64

3. Build → Build Solution

Key Dependency

The scanner links against ntdll.lib for low-level NT path operations:

#pragma comment(lib, "ntdll.lib")

Output

6. Build All From Command Line

If you prefer MSBuild from a Developer Command Prompt:

# Build the driver (Release, ARM64)
msbuild "Windows File System Minifilter\Windows File System Minifilter.vcxproj" /p:Configuration=Release /p:Platform=ARM64

# Build the monitor
msbuild "FsMinifilterMonitor\FsMinifilterMonitor.vcxproj" /p:Configuration=Release /p:Platform=ARM64

# Build the scanner
msbuild "scanner\scanner.vcxproj" /p:Configuration=Release /p:Platform=ARM64

Replace ARM64 with x64 for Intel/AMD machines.

7. Multi-Architecture Notes

flowchart LR
    subgraph ARM64["ARM64 Target"]
        A1["WindowsFileSystemMinifilter.sys (ARM64)"]
        A2["FsMinifilterMonitor.exe (ARM64)"]
        A3["scanner.exe (ARM64)"]
    end

    subgraph x64["x64 Target"]
        X1["WindowsFileSystemMinifilter.sys (x64)"]
        X2["FsMinifilterMonitor.exe (x64)"]
        X3["scanner.exe (x64)"]
    end

    style ARM64 fill:#4361ee,color:#fff
    style x64 fill:#2d6a4f,color:#fff

Critical: All three components must be built for the same architecture as the target machine. You cannot mix ARM64 driver with x64 user-mode apps.

8. Post-Build

After building all components:

1. Driver — Install via InstallDriver.cmd (see Installing the Driver)
2. Monitor & Scanner — Copy to any directory on the target machine and run directly

Next Steps

• Install the driver: Installing the Driver
• First run walkthrough: Getting Started