Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Strange behavior with FILE_ATTRIBUTE_TEMPORARY on FAT FS (16, 32, Ex)

bastien_thonnatbastien_thonnat Member Posts: 26

Hello guys,

I tried to run HLK "File IO 2 Tests" on my minifilter but it failed on Fat FS because the attribute FILE_ATTRIBUTE_TEMPORARY was cleared on the file when the last handle was closed (UDF, REFS and NTFS pass the test).

In my Cleanup Pre/Post operation callback, the FileObject has the flag FO_TEMPORARY_FILE but when I reopen it, the attribute was cleared.

I tried to debug fastfat.sys, from the open to the close, the FCB->FcbState has FCB_STATE_TEMPORARY and the FileObject->Flags has FO_TEMPORARY_FILE.

I don't understand how/when/why the flag is cleared after the last handle is closed.

It's possible that the CacheManager clear this bit in specific case ?


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,266

    And you've checked the (hopelessly out of date, but still slightly useful) sources?

    From your symtoms, my bet would be that FAT (the on disk structure) has nowhere to store this bit and so FAT (the FSD) stores the value in the FCB so when the F B is vaporized (just after the last close) the bit goes away. Why your filter impacts this is a mystery

  • bastien_thonnatbastien_thonnat Member Posts: 26

    Yes I have checked the sources, but can't find anything related to this attribute.
    fastfat just set or clear the attribute but do nothing with it.

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,266

    Sounds like my hypothesis is correct then (I haven't looked at the code). For as long as the FCB exists the value is returned, as soon as its gone the attribute is gone. In that case it is strange that the test look for persistence in the FAT case.

  • bastien_thonnatbastien_thonnat Member Posts: 26

    The strange fact is that when I run the test without my driver, FAT FS pass the test.
    And I don't use FltSetInformationFile with BasicInfo or another InformationClass with attributes...

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,266

    So you need to work out what your filter is doing to cause the FCB to be ejected - and if this is the case (A break point on the last close might be instructive).

    And if you can definitively prove that the test is in error (which I should emphasise is only a hypothesis right now) you could try to raise this with the test people at Microsoft. I suspect that they no longer lurk in here, but someone else in this list might know how to proceed...

  • bastien_thonnatbastien_thonnat Member Posts: 26

    Honestly I don't think the test is in error.

    It's just that I don't understand the fast enought at this time ! I will dig your hypothesis.

    Thank you again for your time rob.

  • bastien_thonnatbastien_thonnat Member Posts: 26

    I found it !

    The test is in error, this attribute is not used by the FAT, when you set this attribute, you don't see the IRP_MJ_CLOSE, only the IRP_MJ_CLEANUP, because CcManager keep the FileObject alive to preserve this attribute.
    If you restart Windows or unmount the drive, the file lost this attribute.

    I will create another post to contact the test peoples.

    Thank you for all rob !

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online