When I call FltPareseFileNameInformation in my minifilter sometimes the
ParentDir includes the share name, sometimes it doesn’t. I am attaching to
\Device\LanmanRedirector. The doc of FltParseFileNameInformation suggests
that when receiving a normalized file name of a remote file, the ParentDir
does not include the share but most often it does. I have found this to be
true only on Vista where my filter gets attached to \Device\MUP instead but
I have to test on more OSes because the doc suggests it shouldn’t. Attaching
to \Device\MUP directly when not on Vista does not seem to work. I have read
about the MUP changes in Vista but it doesn’t talk about these
inconsistencies. Is there any advice you can give to make my minifilter
consistent among the various OS other than not relying on the information
returned by FltParseFileNameInformation ?
Thanks,
/Daniel
http://www.resplendence.com
IIRC, FltMgr on XP SP2 was inconsistent with other OSes and MS fixed this in Aug
2006 update. All other OSes behaved the same way. Check this before going further.
It was mentioned on the list around that time, and most have implemented a simple
workaround, in case the filter gets loaded on earlier XP releases, as it was trivial
to do so.
IF you get inconsistent results on Vista, Srv03 and XP updated after Aug 2006,
please post back.
D.
Daniel Terhell wrote:
When I call FltPareseFileNameInformation in my minifilter sometimes the
ParentDir includes the share name, sometimes it doesn’t. I am attaching to
\Device\LanmanRedirector. The doc of FltParseFileNameInformation suggests
that when receiving a normalized file name of a remote file, the ParentDir
does not include the share but most often it does. I have found this to be
true only on Vista where my filter gets attached to \Device\MUP instead but
I have to test on more OSes because the doc suggests it shouldn’t. Attaching
to \Device\MUP directly when not on Vista does not seem to work. I have read
about the MUP changes in Vista but it doesn’t talk about these
inconsistencies. Is there any advice you can give to make my minifilter
consistent among the various OS other than not relying on the information
returned by FltParseFileNameInformation ?
Thanks,
/Daniel
http://www.resplendence.com
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
Thanks for pointing out, it appears not to be so bad after all.
/Daniel
“Dejan Maksimovic” wrote in message news:xxxxx@ntfsd…
>
> IIRC, FltMgr on XP SP2 was inconsistent with other OSes and MS fixed
> this in Aug
> 2006 update. All other OSes behaved the same way. Check this before going
> further.
> It was mentioned on the list around that time, and most have
> implemented a simple
> workaround, in case the filter gets loaded on earlier XP releases, as it
> was trivial
> to do so.
> IF you get inconsistent results on Vista, Srv03 and XP updated after
> Aug 2006,
> please post back.
>
> D.
>
> Daniel Terhell wrote:
>
>> When I call FltPareseFileNameInformation in my minifilter sometimes the
>> ParentDir includes the share name, sometimes it doesn’t. I am attaching
>> to
>> \Device\LanmanRedirector. The doc of FltParseFileNameInformation suggests
>> that when receiving a normalized file name of a remote file, the
>> ParentDir
>> does not include the share but most often it does. I have found this to
>> be
>> true only on Vista where my filter gets attached to \Device\MUP instead
>> but
>> I have to test on more OSes because the doc suggests it shouldn’t.
>> Attaching
>> to \Device\MUP directly when not on Vista does not seem to work. I have
>> read
>> about the MUP changes in Vista but it doesn’t talk about these
>> inconsistencies. Is there any advice you can give to make my minifilter
>> consistent among the various OS other than not relying on the information
>> returned by FltParseFileNameInformation ?
>>
>> Thanks,
>>
>> /Daniel
>> http://www.resplendence.com
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> –
> Kind regards, Dejan
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>