Target audience

Novice users   Intermediate users   Power users   System administrators   Support engineers   Application developers   Kernel developers

Currently we are offering source code of the following Windows kernel drivers. These are Windows kernel mode drivers which require the WDK (Windows Driver Kit) to be compiled.

Note that these are published for educational purposes only, you may not use any portion of this source code in any product, commercial or otherwise, without our written permission.

Undeluxe minifilter driver source

This is a minifilter file system filter driver which captures deleted files to a recycle bin of your choice. It intercepts file system requests used for deleting files. It can coexist with the Explorer recycle bin. Unlike the standard Windows recycle bin, which is purely an Explorer concept implemented in usermode, this driver captures files deleted by any application.

The biggest challenge in developing this driver is the ability to handle subsequent delete and "undelete" requests. An application can issue multiple IRP_MJ_SET_INFORMATION / FileDispositionInformation requests with DeleteFile flag set to TRUE or FALSE. Explorer makes use of this technique because it first wants to find out if a delete operation will succeed before moving it to the (standard WIndows) recycle bin.

Undelex can be activated on both local and remote drives. It offers filtering capabilities so only files of your choice will be protected. It works on all versions of Windows which have the filter manager installed (on Windows XP Service Pack 2 is required). It compiles and runs on both x86 and x64 editions of Windows.

Click here to download the Undelex minifilter source code (x86 and x64).
Current version: 1.00, August 2010

ObjMon driver source

We are offering the source of the ObjMon driver of the ObjMon utility. It shows how object type callouts can be used for the purpose of a kernel object activity monitor. The driver compiles and runs on both x86 and x64 versions of WIndows.
Note that this driver is for concept only. The technique it uses is controversial and should not be used in normal Windows drivers. On x64 editions of Windows there is a chance that the operation of this driver is stopped by PatchGuard with a 0x109 bugcheck.

Click here to download the ObjMon driver source code (x86 and x64).