Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category.

Re[2]: Re[2]: How to filter the request in MUP?

Sorry if I missed something but how is your filter 'creating' a file
object in pre-create? Are you saying that you call FltCreateFileEx() and
this is the FO you are 'creating'?

In your InstanceSetup callback, for network attachments (though not for
every share), you'll see the VolumeDeviceType as
FILE_DEVICE_NETWORK_FILE_SYSTEM and the VolumeFilesystemType as a
network file system as in the FLT_FSTYPE_xxx types.


Kernel Drivers
Windows File System and Device Driver Consulting

------ Original Message ------
From: "" <>
To: "Windows File Systems Devs Interest List" <>
Sent: 12/7/2017 9:53:29 AM
Subject: RE:[ntfsd] Re[2]: How to filter the request in MUP?

>I mean the file object indicated is not really created, my encryption
>filter create a file object in the pre-create routine and just return
>STATUS_SUCCESS to the upper driver.
>How to filter the network attachments in InstanceSetup callback, that's
>exactly my question.
>NTFSD is sponsored by OSR
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at <>;
>To unsubscribe, visit the List Server section of OSR Online at

Kernel Drivers
Windows File System and Device Driver Consulting


  • Yes, my filter 'creating' a file object in pre-create with FltCreateFile(), so the FileObject upper driver wants to create just remains a pointer but not a real FileObject(created). The file object created by my filter is used to substitute for the FileObject(fake) in all of the callbacks such as IRP_MJ_SETXXX/IRP_MJ_READ/IRP_MJ_WRITE and so on, it works well.
    My filter used the same logic for the file stored in the network(\device\mup\test\ccedr.txt), my filter create a file object in the pre-create(so my filter should have attach to the mup device), but not catch the following requests(IRP_MJ_READ/IRP_MJ_WRITE/IRP_MJ_SETXXX...), so it get BSOD says the FileObject can not be resolved, if my filter catch the request and substitute the fake one, it should be okay.
  • I just don't understand why my filter can not catch the following request?
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!