Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home› NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Can not open file in the callback of IRP_MJ_SET_INFORMATION post operation

ruslan090ruslan090 Member Posts: 3
in NTFSD

Hello. As the title implied, I have a problem in opening file in the callback of IRP_MJ_SET_INFORMATION post operation.
My project is inherited from Microsoft "scanner" minifilter project in github.
I want to open file after the file is renamed. So I registered callbacks to IRP_MJ_SET_INFORMATION event.
Originally I tried to open a file in pre operation callback. But file handler is not fully released, so failed in opening file.
So I tried to open file in post operation of IRP_MJ_SET_INFORMATION event. But still can not open file.
What should I do if I want to open file in that callback?
Thanks in advance.

· Share on Facebook

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,210
    • What is the status that you get. That is usually a good hint
    • Odd things happen after rename of a file on RDR, is this your situation?
    • What does “ But file handler is not fully released, so failed in opening file” mean. No I am not going to the sample code
    · Share on Facebook
  • ruslan090ruslan090 Member Posts: 3

    Thanks for your reply.

    @rod_widdowson said:

    • What is the status that you get. That is usually a good hint

    Driver mode send file path to user mode. Then, user mode tries to open that file using "fopen". GetLastError returns 32. It means:ERROR_SHARING_VIOLATION The process cannot access the file because it is being used by another process.

    · Share on Facebook
  • ruslan090ruslan090 Member Posts: 3

    BTW, Is there any way to giveup file access privilege so other process can access that file in minifilter?

    · Share on Facebook
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Sign In Register
Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers TBD Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online

Categories