How to redirect IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?

NTFSD
1

Hi everyone I am new in filter driver developing and I try to implement a mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with this condition:
an incoming file say (6.dat) is redirected only if it is a new file(already isn’t in The c:\a\b directory).
this work fine till IRP_MJ_DIRECTORY_CONTROL comes.
if in dir c:\a\b have these files
1.dat
2.dat
and in e:\c\b
4.dat
5.dat
and user in cmd execute this statement
dir 4.dat
the result is “STATUS_NO_SUCH_FILE”.
it’s because the b folder is already in c:\a and when our driver gets IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat file.
now that’s my question how I can fix this problem?
is there any way to redirect IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?
thanks in advance

2

This particular scenario is extremely complex.
You cannot simply redirect IRP_MJ_DIRECTORY_CONTROL (technically, you
can, simply replace the Data->Iopb->TargetFileObject with the file
object of the redirected folder) because you do not know if the file
is already present.
You can reissue the call with your own file object, BUT you have to
keep track of the FileName and two important flags (return single
entry, and restart scan). You also have to reset Restart Scan
properly…

It is too complex to explain in a post. You will have to work with
above, using try/error approach. That will show you what specifically
needs to be tuned for your scenario.
It took me about a month to get this done, even though processing
directory listing is something I started before IFS Kit was available
(1998). It is not that it requires a lot of experience, per se, rather
that it requires a lot of fine tuning for the particular scenario.

Dejan.

Hi everyone I am new in filter driver developing and I try to implement a
mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with
this condition:

an incoming file say (6.dat) is redirected only if it is a new file(already
isn’t in The c:\a\b directory).

this work fine till IRP_MJ_DIRECTORY_CONTROL comes.

if in dir c:\a\b have these files

1.dat

2.dat

and in e:\c\b

4.dat

5.dat

and user in cmd execute this statement

dir 4.dat

the result is “STATUS_NO_SUCH_FILE”.

it’s because the b folder is already in c:\a and when our driver gets
IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat
file.

now that’s my question how I can fix this problem?

is there any way to redirect
IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?

1 Like
3

Thanks for your response Dejan

4

Thanks for your response Dejan
can you tell me how to replace the Data->Iopb->TargetFileObject with the file object of the redirected folder?
I tried this approach:
In the preDirectoryControl return FLT_PREOP_SYNCHRONIZE
and in the postDirectoryControl replace the Data->Iopb->TargetFileObject with my redirected folder path with IoReplaceFileObjectName then call FltSetCallbackDataDirty and FltReissueSynchronousIo
but always get STATUS_NO_MORE_FILES

@Dejan_Maksimovic said:
This particular scenario is extremely complex.
You cannot simply redirect IRP_MJ_DIRECTORY_CONTROL (technically, you
can, simply replace the Data->Iopb->TargetFileObject with the file
object of the redirected folder) because you do not know if the file
is already present.
You can reissue the call with your own file object, BUT you have to
keep track of the FileName and two important flags (return single
entry, and restart scan). You also have to reset Restart Scan
properly…

It is too complex to explain in a post. You will have to work with
above, using try/error approach. That will show you what specifically
needs to be tuned for your scenario.
It took me about a month to get this done, even though processing
directory listing is something I started before IFS Kit was available
(1998). It is not that it requires a lot of experience, per se, rather
that it requires a lot of fine tuning for the particular scenario.

Dejan.

Hi everyone I am new in filter driver developing and I try to implement a
mini-filter driver that driver redirect files from dir c:\a\b to e:\c\b with
this condition:

an incoming file say (6.dat) is redirected only if it is a new file(already
isn’t in The c:\a\b directory).

this work fine till IRP_MJ_DIRECTORY_CONTROL comes.

if in dir c:\a\b have these files

1.dat

2.dat

and in e:\c\b

4.dat

5.dat

and user in cmd execute this statement

dir 4.dat

the result is “STATUS_NO_SUCH_FILE”.

it’s because the b folder is already in c:\a and when our driver gets
IRP_MJ_CREATE does not redirect dir from c:\a\b to e:\c\b and found 4.dat
file.

now that’s my question how I can fix this problem?

is there any way to redirect
IRP_MJ_DIRECTORY_CONTROL\IRP_MN_QUERY_DIRECTORY?

5

Uhh. You need to replace it PreCreate by setting it to a file object you
opened for your folder.

And call FltSetCallbackDataDirty.

1 Like