Data->Iopb->TargetInstance vs FltObject->Instance

NTFSD
1

In mini filter callback routines, there two variable passed in which are
Data->Iopb->TargetInstance
FltObject->Instance
Both are type of PFLT_INSTANCE.

Same problem is also apply to the FILE_OBJECT type. They are two variables are passed in as argument which are;
Data->Iopb->TargetFileObject and
FltObjects->FileObject

In “change” example, both are used calling different library function.

What is the difference and which one must be referenced by calling Flt… library functions.

Murad

Regards

2

The differences are subtle:

The Iopb one is a Parameter to the request and can be changed, just as any
of the contents of the Iopb can. It is only valid for as long as the iopb
is valid (so, for instance if you call a FltFunction (or any other function)
passing in the FLT_CALLBACK_DATA structure and that function returns
FLT_PREOP_PENDING then you MUST NOT look at that value any longer.

The FltObjects one is a parameter to the Function call and so it valid for
the entire function call. However it is strictly an input only function.

My general habit is to always use the FltObjects ones (up to and including
putting the values in an associated context). Most simple filters will use
them interoperably. A quick scan of the change minifilter shows that it
doesn’t go into any of the danger areas, further is uses the
FLT_CALLBACK_DATA as the “context” to subfunctions and so grabbing the
parameters from it make sense structurally.

3

Hi Rod

Before asking my question, I realized that one pair of them is defined as

PFLT_INSTANCE CONST Instance;
PFILE_OBJECT CONST FileObject;

in FLT_RELATED_OBJECTS structure which is passed as “FltObjects” variable. But, the others are not defined as CONST in Data->Iopb. I can understand the difference but seems weird to me.

Thanks

4

in FLT_RELATED_OBJECTS structure which is passed as “FltObjects” variable. But, the others are not defined as CONST in Data->Iopb. I can understand the difference but seems weird to me.

Little, if anything, in the kernel APIs uses const pointers. I use const_cast constantly :slight_smile: to convert my const pointers to non-const when calling API calls or working with API structures that fail to declare const pointers as const.