Calling FltQueryInformationFile in PostOp

I’m trying to determine if a write happens at the end of a file inside my
minifilter. Sometimes the Parameters.Write.ByteOffset indicates that, but
other times it only indicates that the write is happening at the “current
file position”. In those case I’m doing roughly the following in my
PostOperationCallback function:

switch(Data->Iopb->MajorFunction)

{

case IRP_MJ_WRITE:

if(PASSIVE_LEVEL == KeGetCurrentIrql())

{

unsigned char buff1[sizeof(FILE_POSITION_INFORMATION) *
2];

unsigned char* pBuffPosInfo = buff1;

//use current file pointer – is it at the end?

pBuffPosInfo = (unsigned
char*)ROUND_TO_64BIT((__int64)pBuffPosInfo);

if(STATUS_SUCCESS ==
FltQueryInformationFile(Data->Iopb->TargetInstance,
Data->Iopb->TargetFileObject, pBuffPosInfo,
sizeof(FILE_POSITION_INFORMATION), FilePositionInformation, NULL))

{

unsigned char
buff2[sizeof(FILE_STANDARD_INFORMATION) * 2];

unsigned char* pBuffStdInfo = buff2;

pBuffStdInfo = (unsigned
char*)ROUND_TO_64BIT((__int64)pBuffStdInfo);

if(STATUS_SUCCESS ==
FltQueryInformationFile(Data->Iopb->TargetInstance,
Data->Iopb->TargetFileObject, pBuffStdInfo,
sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation, NULL))

{

if(((FILE_POSITION_INFORMATION*)pBuffPosInfo)->CurrentByteOffset.QuadPart >=
((FILE_STANDARD_INFORMATION*)pBuffStdInfo)->EndOfFile.QuadPart)

//write was at the end!!

}

}

}

break;

}

This seemed to work well (as far as I’ve tested so far), but I’ve discovered
that my minifilter no longer unloads, and the calls to
FltQueryInformationFile were the only changes made. Do I need to somehow
undo this call, or perhaps only do it in the PreOperationCallback? Any
other thoughts?

Thanks for any feedback.

Doug

Enable Driver Verifier on Vista with everything excluding low resource simulation for your driver and fltmgr.sys. Try to unload and usually Driver Verifier will tell you what’s not freed

Thanks Vance. I decide my approach of calling FltQueryInformationFile
wasn’t very solid anyway, so removing that code and everything is back to
stable again.

Instead, now I’m tracking IRP_MJ_QUERY_INFORMATION and
IRP_MJ_SET_INFORMATION to find the current file pointer and the end of file,
and considering the different values of ByteOffset in IRP_MJ_READ and
IRP_MJ_WRITE.

Doug

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-357131-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Wednesday, March 04, 2009 9:51 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Calling FltQueryInformationFile in PostOp

Enable Driver Verifier on Vista with everything excluding low resource
simulation for your driver and fltmgr.sys. Try to unload and usually
Driver Verifier will tell you what’s not freed


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

look at fastfat source
current filepos is defined as FileObject.CurrentByteOffset, but getting
filesize is more difficult

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug
Sent: 5. b?ezna 2009 14:06
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Calling FltQueryInformationFile in PostOp

Thanks Vance. I decide my approach of calling FltQueryInformationFile
wasn’t very solid anyway, so removing that code and everything is back to
stable again.

Instead, now I’m tracking IRP_MJ_QUERY_INFORMATION and
IRP_MJ_SET_INFORMATION to find the current file pointer and the end of file,
and considering the different values of ByteOffset in IRP_MJ_READ and
IRP_MJ_WRITE.

Doug

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-357131-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Wednesday, March 04, 2009 9:51 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Calling FltQueryInformationFile in PostOp

Enable Driver Verifier on Vista with everything excluding low resource
simulation for your driver and fltmgr.sys. Try to unload and usually
Driver Verifier will tell you what’s not freed


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer