Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How to redirect IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?

VahidVahid Member Posts: 3

Hi everyone I am new in filter driver developing and I try to implement a mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with this condition:
an incoming file say (6.dat) is redirected only if it is a new file(already isn't in The c:\a\b directory).
this work fine till IRP_MJ_DIRECTORY_CONTROL comes.
if in dir c:\a\b have these files
1.dat
2.dat
and in e:\c\b
4.dat
5.dat
and user in cmd execute this statement
dir 4.dat
the result is "STATUS_NO_SUCH_FILE".
it's because the b folder is already in c:\a and when our driver gets IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat file.
now that's my question how I can fix this problem?
is there any way to redirect IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?
thanks in advance

Comments

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 303
    via Email
    This particular scenario is extremely complex.
    You cannot simply redirect IRP_MJ_DIRECTORY_CONTROL (technically, you
    can, simply replace the Data->Iopb->TargetFileObject with the file
    object of the redirected folder) because you do not know if the file
    is already present.
    You can reissue the call with your own file object, BUT you have to
    keep track of the FileName and two important flags (return single
    entry, and restart scan). You also have to reset Restart Scan
    properly...

    It is too complex to explain in a post. You will have to work with
    above, using try/error approach. That will show you what specifically
    needs to be tuned for your scenario.
    It took me about a month to get this done, even though processing
    directory listing is something I started before IFS Kit was available
    (1998). It is not that it requires a lot of experience, per se, rather
    that it requires a lot of fine tuning for the particular scenario.

    Dejan.

    >
    > Hi everyone I am new in filter driver developing and I try to implement a
    > mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with
    > this condition:
    >
    > an incoming file say (6.dat) is redirected only if it is a new file(already
    > isn't in The c:\a\b directory).
    >
    > this work fine till IRP_MJ_DIRECTORY_CONTROL comes.
    >
    > if in dir c:\a\b have these files
    >
    > 1.dat
    >
    > 2.dat
    >
    > and in e:\c\b
    >
    > 4.dat
    >
    > 5.dat
    >
    > and user in cmd execute this statement
    >
    > dir 4.dat
    >
    > the result is "STATUS_NO_SUCH_FILE".
    >
    > it's because the b folder is already in c:\a and when our driver gets
    > IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat
    > file.
    >
    > now that's my question how I can fix this problem?
    >
    > is there any way to redirect
    > IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?
  • VahidVahid Member Posts: 3
    edited April 19

    Thanks for your response Dejan

  • VahidVahid Member Posts: 3

    Thanks for your response Dejan
    can you tell me how to replace the Data->Iopb->TargetFileObject with the file object of the redirected folder?
    I tried this approach:
    In the preDirectoryControl return FLT_PREOP_SYNCHRONIZE
    and in the postDirectoryControl replace the Data->Iopb->TargetFileObject with my redirected folder path with IoReplaceFileObjectName then call FltSetCallbackDataDirty and FltReissueSynchronousIo
    but always get STATUS_NO_MORE_FILES

    @Dejan_Maksimovic said:
    This particular scenario is extremely complex.
    You cannot simply redirect IRP_MJ_DIRECTORY_CONTROL (technically, you
    can, simply replace the Data->Iopb->TargetFileObject with the file
    object of the redirected folder) because you do not know if the file
    is already present.
    You can reissue the call with your own file object, BUT you have to
    keep track of the FileName and two important flags (return single
    entry, and restart scan). You also have to reset Restart Scan
    properly...

    It is too complex to explain in a post. You will have to work with
    above, using try/error approach. That will show you what specifically
    needs to be tuned for your scenario.
    It took me about a month to get this done, even though processing
    directory listing is something I started before IFS Kit was available
    (1998). It is not that it requires a lot of experience, per se, rather
    that it requires a lot of fine tuning for the particular scenario.

    Dejan.

    >

    Hi everyone I am new in filter driver developing and I try to implement a
    mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with
    this condition:

    >

    an incoming file say (6.dat) is redirected only if it is a new file(already
    isn't in The c:\a\b directory).

    >

    this work fine till IRP_MJ_DIRECTORY_CONTROL comes.

    >

    if in dir c:\a\b have these files

    >

    1.dat

    >

    2.dat

    >

    and in e:\c\b

    >

    4.dat

    >

    5.dat

    >

    and user in cmd execute this statement

    >

    dir 4.dat

    >

    the result is "STATUS_NO_SUCH_FILE".

    >

    it's because the b folder is already in c:\a and when our driver gets
    IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat
    file.

    >

    now that's my question how I can fix this problem?

    >

    is there any way to redirect
    IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 303
    via Email
    Uhh. You need to replace it PreCreate by setting it to a file object you
    opened for your folder.

    And call FltSetCallbackDataDirty.
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA