Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Learning file system driver development

0xrepnz0xrepnz Member Posts: 88

Hey,
I read the NT file system internals book and I already have experience with windows kernel development. I don't have much experience with minifilter / legacy file system drivers (other than very simple filters) and I want to learn how to develop file systems. This is mainly for fun and education. My first goal is to develop a simple file system driver that stores the data of files in memory. I understand that a real file system has MANY more complications because it has to deal with real disk I/O, But I first want to understand the API between file system drivers and other kernel components like the cache manager, memory manager and I/O manager - After that I can try to use the disk to store the information. I can try to compile the examples from the NT file system internals book but I'm not sure they'll even work on a latest windows 10 machine because this book is old. My second option is to try and understand the fastfat or cdfs source code from the windows driver samples. I know that nowadays I don't really have a reason to develop a file system driver and even not a "legacy" file system filter - Most developers use minifilter drivers in their products. The main reason I don't think I should learn this topic through minifilter drivers is because I want to understand in detail how file systems work in NT, and I'm worried that mini-filter drivers can hide important details because of their abstractions.

  1. How do you think I should continue learning file system driver development in Windows after reading NT file system internals?
  2. Do you know a simple open-source file system I can learn and use as a basis for another file system?
  3. I saw some references to the "IFS Toolkit" in some old forums. Does it still exist? Does it contain any useful information about file systems? I guess that it is provided for free in this section of MSDN today.

I really appreciate the answers!

- Ori Damari

Comments

  • Don_BurnDon_Burn Member - All Emails Posts: 1,764

    First you have made a poor assumption, the disk I/O portion of a file system is one of the easier items, things like the cache manager and memory mapped I/O are where a lot of the pain is. Your statement about developers not having a reason to develop file system drivers is incorrect, over the last 20 years I have worked on four unique file systems for Windows.

    Filters are a totally different matter. You should be aware that legacy file system filters are no longer supported so there is no reason to try to understand them.

    The WDK stuff is the old IFS Toolkit.

  • 0xrepnz0xrepnz Member Posts: 88
    edited August 2020
    Thanks for correcting me. I'm actually pretty new to file system drivers (and kernel development im general). I'm happy to hear that people continue to develop file system drivers. How do you think I should approach learning this topic?
    - Ori Damari
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 467
    via Email
    Are you sure?
    IIRC, there is only an option for admins to disable their use, but it
    is not yet completely obsolete.

    > You should be aware that legacy
    > file system filters are no longer supported so there is no reason to try to
    > understand them.
  • 0xrepnz0xrepnz Member Posts: 88
    > You should be aware that legacy file system filters are no longer supported so there is no reason to try to understand them.

    I don't completely agree with this, I think there's an educational value in understanding the old design in order to understand the benefits of the new design. Also, I'm doing this mainly for just fun, it's not like I'm going to develop a legacy file system filter in any product. For example in order to understand how fltmgr.sys works, it can be useful to understand how legacy file systems are implemented. Anyway I'm not here to argue about this, I'm doing this mainly to satisfy my curiosity.

    If you know more samples of file system drivers other than fastfat and cdfs, it will be useful.

    Thanks:)
    - Ori Damari
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,496

    Writing a Windows file system is a monster PITA. Sorry, couldn't proceed further until I said that...

    I do not know of any tutorial examples of a Windows file system. FASTFAT is pretty good in that it demonstrates an actual production Windows file system, though production usually does not equal a good tutorial. If you really wanted to start from scratch and only care about Mm/Cc/Io interactions I would try going with a monolithic network file system (see FsRtlRegisterUncProvider). The benefit there is that you avoid having to deal with the mount (and lock, and PnP, and...). And, of course, you don't actually have to go over the network to satisfy the incoming I/O requests.

    You might need to deal with cobbling together a network provider DLL at some point. Though IIRC you don't need it if you're willing to hard code the server/share path and not use drive letters (it's been a long time).

    If you really want a local media file system then you'll need to start with the mount path. You'll also probably need a utility to format a volume with your own file system structure so that it's not claimed by the other file systems.

    WRT to legacy file system filters, your best bet is to track down an old Vista WDK. That has the source to a simple filter as well as FileSpy. Both of these should give you a good idea as to the annoyances of getting a legacy filter up and running.

    -scott
    OSR

  • Bo_BranténBo_Brantén Member Posts: 104

    If you know more samples of file system drivers other than fastfat and cdfs, it will be useful.

    The Ext2Fsd project is probably the best quality open source filesystem driver for Windows these days, it supports ext2, ext3 and ext4 on Windows 10.

  • 0xrepnz0xrepnz Member Posts: 88

    Yeah I saw it, Anyway I think I'll start by making modifications to the fastfat source code to customize certain things, debug and try to explore certain interesting code paths. This fastfat code is pretty complex, but I guess there are no "simple examples" of file systems anyway, I assume there are just too many cases that have to be handled, simply ignoring these cases can introduce bugs or limitations in the FS..

    Thanks for helping! :)

    - Ori Damari
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 12 September 2022 Live, Online
Internals & Software Drivers 23 October 2022 Live, Online
Kernel Debugging 14 November 2022 Live, Online
Developing Minifilters 5 December 2022 Live, Online