Purpose of FSRTL_ADVANCED_FCB_HEADER.ReservedContext?

NTFSD
1

Hi,

Which is the purpose of FSRTL_ADVANCED_FCB_HEADER->ReservedContext field?

I saw sometimes points to a double-linked list used by the filter manager driver (using FsRtlInsertReservedPerStreamContext/FsRtlLookup… apis) but would like to know if it has a specific meaning.

Regards,
Mauro.

2

There’s a comment in the header, not sure if you’ll get any more detail than that:

#if (NTDDI_VERSION >= NTDDI_WINBLUE)

//
// This field is used internally by the FSRTL to assist in context lookup.
//

PVOID ReservedContext;

#endif

-scott
OSR
@OSRDrivers

3

// This field is used internally by the FSRTL to assist in context
lookup.

ISTR that it is used to point to something which helps the FILE (as opposed
to STREAM) context lookup. IIRC when I reserached it it turns up at the
same time… But you probably don’t want to care unless you are having fcb
lookup issues

4

Hi guys,

As a research, I was trying to figure out why Cloud minifilter calls FltGetStreamContext on a file that has just been opened. Found the ReservedContext field points to a double-linked list and that list contains ONE item.

I thought the stream, file, (etc) context lists would be empty when a file is opened.

Regards,
Mauro.