Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Loop in filter oplock

MorenettMorenett Member Posts: 4

I'm trying to wtite an user-mode application with filter oplock.



NtFsControlFile(file_handle, nullptr, nullptr, nullptr, &iostatus, FSCTL_REQUEST_FILTER_OPLOCK, nullptr, 0, nullptr, 0);

returns STATUS_PENDING (success).

and if I call for example:

NtCreateFile(&file_handle, SYNCHRONIZE | FILE_READ_DATA, &oa, &iostatus, nullptr, 0, FILE_SHARE_READ, FILE_OPEN, 0, nullptr, 0);

it rises in an endless cycle. There is only one handle of this file.
I expected to read file and don't give sharing violation error to other applications. But my application can't read file too.
What have I done wrong?


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    Not something I've done a lot of but looking here it looks as though you are expected to provide both an input and an output buffer.

    I've not looked recently but @Ladislav_Zezula added oplocks to the awesome filetest some time ago. I'd go look at it. That might provide insight

  • MorenettMorenett Member Posts: 4
    edited January 2019

    FSCTL_REQUEST_OPLOCK is only from Windows 7. So I use FSCTL_REQUEST_FILTER_OPLOCK and MSDN says that buffer should be zeroes.
    I used FileTest, but it don't create oplocks, I only can set the FILE_RESERVE_OPFILTER in create options, as I understood :(

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195


    I beg your pardon, I didn't check my search output carefully enough.

    I used FileTest, but it don't create oplocks,

    I think you want to download a newer version. See for instance the code here Note that it sets the second parameter to {{NtFsControlFile}}

    Also I'm assuming that you have missed out the bit where you acknowledge the oplock (but bear in mind that I haven't done much umode programming of oplocks)

  • MorenettMorenett Member Posts: 4

    Oh, you are right, sorry, newer version has it!
    As I understood from programm:
    1. I open file with FILE_READ_ATTRIBUTES and all FILE_SHARE_XXX.
    2. Use ioctl (FSCTL_REQUEST_FILTER_OPLOCK) to get filter oplock.
    And after I try open file as monopoly access (without any FILE_SHARE_XXX)? But It breaks the oplock immediately, so I can't get new handle without FILE_SHARE_XXX.
    What can I do in this situation? I need open file monopoly and other application shouldn't get sharing violation error.

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    I'd be tempted to take a look at procmon or filetest and see what's breaking the oplock (but thats how my mind works). I'd also prototype it all in FileTest.

    And beware of applications calling with "COMPLETE_IF_OPLOCKED"

  • Gabriel_BerceaGabriel_Bercea Member - All Emails Posts: 482

    The described scenario you provided should work. That is the correct way to acquire a filter oplock with a "reservation" from the create.
    Possible things that may break oplocks are filters on the stack.
    Can you please post what other FS filters are on the stack. Post the output of "fltmc" from an elevated cmd.



Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging 15 November 2021 Live, Online