In mini-filter driver i have observed if FO is opened with “FLT_CALLBACK_DATA::Iopb->Parameters.Create.Options” contains “FILE_OPEN_FOR_BACKUP_INTENT” flag set then FltQueryInformationFile able gave the file Allocation Size but failed to give the EOF(Returns zero as file size though file is not empty).
If we clear this flag in PreCreateCallback() then everything works fine.
Does any one came across with such problem.
As per MSDN FILE_OPEN_FOR_BACKUP_INTENT : “The file is being opened for backup intent; therefore, the system should check for certain access rights and grant the caller the appropriate accesses to the file before checking the input DesiredAccess against the file’s security descriptor.”
Thanks
Does not sound right to me. You can verify that this is not the case with
FileTest.
Any chance this is a destructive open? Note that you can specify an
allocation size on create.
-scott
OSR
@OSRDrivers
wrote in message news:xxxxx@ntfsd…
In mini-filter driver i have observed if FO is opened with
“FLT_CALLBACK_DATA::Iopb->Parameters.Create.Options” contains
“FILE_OPEN_FOR_BACKUP_INTENT” flag set then FltQueryInformationFile able
gave the file Allocation Size but failed to give the EOF(Returns zero as
file size though file is not empty).
If we clear this flag in PreCreateCallback() then everything works fine.
Does any one came across with such problem.
As per MSDN FILE_OPEN_FOR_BACKUP_INTENT : “The file is being opened for
backup intent; therefore, the system should check for certain access rights
and grant the caller the appropriate accesses to the file before checking
the input DesiredAccess against the file’s security descriptor.”
Thanks
Yes scott i already verified with FileTest by providing above mentioned flags in NtCreateFile.
Actually this issues occurs with FastCopy tool with N/W share.
Forgot to mention one thing i.e this issue is getting only with files which are opened from N/W Shares like DFS, MAC shares.
For local, removable working fine.
I suggest that you take a close look at your environment then.
Because it seemed weird I just did an
NtCreateFile/FILE_OPEN_FOR_BACKUP_INTENT using FileTest on my dev machine
(Win7) and I saw the correct length.
The other place to start looking is FAT- if this reproduces on FAT then just
build you own DEBUG FAT and step through it.
Hello Rod, thanks for putting personal efforts.
I am able to generate issue with FileTest.exe on O.S: Windows 10 x64 [SMB N/W Share]
FileTest NTCreateFile Attributes:
FileName: ??\UNC<n share filepath>
ObjectAttr.Flags: 0x40
Desired access: 0xC0100000
Allocation Size:0
File Attributes: 0x80
Share access: 0x3
Create Disp : [5] FILE_OVERWRITE_IF
Create options: 0x4024
Privileges: SeChangeNotifyPrivilage & SeBackupPrivilege
Steps:
1. Create File “NtCreateFile” with above settings.
2. Now “NTFileInfo” Click NTQueryInformationFile(FileStandardInformation).
As per expected EOF will be ‘0’.
3. Now write content with “ReadWrite” tab NtWriteFile.
4. Now again do Step 2. But now EOF should be Non Zero but in my case i observed ‘0’ for first time and for second try getting EOF as per expected.
In driver i call FltQueryInformationFile in loop with KeDelayExecutionThread(2 sec), So within 2-3 iterations getting non-zero EOF.
Does any one come across such issues?
When FILE_OPEN_FOR_BACKUP_INTENT" flag is set.