[MKTG]: Re: Read file using original FILE_OBJECT

Yep, reusing the original FO is OK.
As far as oplocks by reusing the FO it is less likely you would break any.
Make sure you do not update the byte offset as you do your I/O operations.

Cheers,
Gabriel

On Mon, Mar 27, 2017 at 7:38 PM, wrote:

> Hello all,
>
> I’d like to create a simple minifilter which makes a file copy for further
> processing if it was written. I based the driver on msdn sample:
> https://github.com/Microsoft/Windows-driver-samples/blob/
> master/filesys/miniFilter/scanner/filter/scanner.c
>
> The logic is simple:
> 1. If file was succesfully created I’m allocating the context
> (FLT_STREAMHANDLE_CONTEXT) in post IRP_MJ_CREATE
> 2. Then in post IRP_MJ_WRITE I’m marking that file was written
> 3. In pre IRP_MJ_CLEANUP I’m reading the file content using FILE_OBJECT I
> was given in FLT_RELATED_OBJECTS structure
>
> Is it safe/fine to read the file using that FILE_OBJECT, in reference to
> potential locks/oplocks? I think it is as I’m using the same file object in
> the process context but I couldn’t find the confirmation.
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
>


Bercea. G.</http:>