I need help. I am reversing
procmon.Sys filesystem minifilter driver which does monitoring.
Question: I need to know if filtering of events is done in user-mode or kernel-mode.
My hypothesis is that all events are sent to user-mode application and then are filtered and displayed.
For now i breakpointed procedure that calls
FilterGetMessage but can't figure out if it returns all events or just filtered events.