Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Windows NT File System Driver - Creation date problems

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hi All,

Currently I am involved in writing some device driver code for windows NT
file systems. Driver provides additional network drive to the winnt user.
Problem is - while creating a file on the new network drive, driver routine
is not populating different date fields (creation date, change date, last
access date, last write date). I tried setting these fields while creating
FCB block and populating FCB.MetaData.Created, FCB.MetaData.Change,
FCB.MetaData.LastAccess, and FCB.MetaData.LastWrite fields - but it does not
seem to work - i am unable to figure out in which format does winnt want
date fields to be populated and whether populating values while creating FCB
block is a good idea or not.... was wondering if anyone has dealt with this
problem before and could provide some insight.

Thanks!
Devang

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Well could'nt understand the problem thoroghly.
    But you can do the following checklist.
    1. Use KeQuerySystemTime( PLARGE_INTEGER time)
    function to get the current time.
    2. Are you getting a call to IRP_MJ_QUERY_INFORMATION
    while accesing network drive.
    If yes then check out the Minor Function
    FileNetworkOpenInformation. Fill out the fields of
    this structure.
    Hope it helps.
    Gurpreet

    --- Devang Shah <[email protected]> wrote:
    > Hi All,
    >
    > Currently I am involved in writing some device
    > driver code for windows NT
    > file systems. Driver provides additional network
    > drive to the winnt user.
    > Problem is - while creating a file on the new
    > network drive, driver routine
    > is not populating different date fields (creation
    > date, change date, last
    > access date, last write date). I tried setting these
    > fields while creating
    > FCB block and populating FCB.MetaData.Created,
    > FCB.MetaData.Change,
    > FCB.MetaData.LastAccess, and FCB.MetaData.LastWrite
    > fields - but it does not
    > seem to work - i am unable to figure out in which
    > format does winnt want
    > date fields to be populated and whether populating
    > values while creating FCB
    > block is a good idea or not.... was wondering if
    > anyone has dealt with this
    > problem before and could provide some insight.
    >
    > Thanks!
    > Devang
    >
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >
    >
    __________________________________________________
    Do You Yahoo!?
    Talk to your friends online with Yahoo! Messenger.
    http://im.yahoo.com
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hey Guys,

    Thanks for the reply - I did try to implement you guys suggestions but no
    luck. To restate the problem - currently we are implementing the device
    driver for the winnt file system. User can create the file on new drive - it
    also shows correct file size but not date field values (creation date,
    change date, last access date..) and also attributes. In the current
    implementation, device driver code is divided into two parts - one runs in
    kernel mode and second one in user mode - they communicate with each other
    using IOCTL - most of the functionality is in user mode driver which is
    written using C++. In the user mode driver part, while handling
    'IRP_MJ_SET_INFORMATION' and informationclass - FileBAsicInformation, code
    is getting data from the kernel mode driver and accordingly populates file
    date and attribute fields. I am assuming that data available from the
    IRP..->AssociatedIRP.SystemBuffer would have values in these fields for me -
    I suspect that this part of the code is not working correctly.

    Also I tried setting those fields in IRP_MJ_QUERY_INFORMATION
    (informationclass - FileNetworkOpenInformation) routine, but problem is i am
    unable to build the program with a call to KeQuerySystemTime() function -
    its giving me link error. I wonder which library will have this function and
    also whether i can call this function from the user mode driver or not.

    Thanks!
    Devang.


    -----Original Message-----
    From: [email protected]
    [mailto:[email protected]]On Behalf Of Gurpreet Anand
    Sent: Monday, March 06, 2000 4:50 PM
    To: File Systems Developers Interest List
    Subject: [ntfsd] Re: Windows NT File System Driver - Creation date
    problems


    Well could'nt understand the problem thoroghly.
    But you can do the following checklist.
    1. Use KeQuerySystemTime( PLARGE_INTEGER time)
    function to get the current time.
    2. Are you getting a call to IRP_MJ_QUERY_INFORMATION
    while accesing network drive.
    If yes then check out the Minor Function
    FileNetworkOpenInformation. Fill out the fields of
    this structure.
    Hope it helps.
    Gurpreet

    --- Devang Shah <[email protected]> wrote:
    > Hi All,
    >
    > Currently I am involved in writing some device
    > driver code for windows NT
    > file systems. Driver provides additional network
    > drive to the winnt user.
    > Problem is - while creating a file on the new
    > network drive, driver routine
    > is not populating different date fields (creation
    > date, change date, last
    > access date, last write date). I tried setting these
    > fields while creating
    > FCB block and populating FCB.MetaData.Created,
    > FCB.MetaData.Change,
    > FCB.MetaData.LastAccess, and FCB.MetaData.LastWrite
    > fields - but it does not
    > seem to work - i am unable to figure out in which
    > format does winnt want
    > date fields to be populated and whether populating
    > values while creating FCB
    > block is a good idea or not.... was wondering if
    > anyone has dealt with this
    > problem before and could provide some insight.
    >
    > Thanks!
    > Devang
    >
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >
    >
    __________________________________________________
    Do You Yahoo!?
    Talk to your friends online with Yahoo! Messenger.
    http://im.yahoo.com

    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    One can call KeQuerySystemTime() in the Kernel mode.
    How exactly are you filling the time attributes.
    U said that u copy the fields in the FCB with the
    time.
    Like FCB.Metadata.CreationTime = ????.
    ???? - Here how are u filling the Structure.
    And what about the datatype of the CreationTime.
    It would be better if u can send the code where this
    operation is being done with the structure of the FCB.
    Gurpreet

    --- Devang Shah <[email protected]> wrote:
    > Hey Guys,
    >
    > Thanks for the reply - I did try to implement you
    > guys suggestions but no
    > luck. To restate the problem - currently we are
    > implementing the device
    > driver for the winnt file system. User can create
    > the file on new drive - it
    > also shows correct file size but not date field
    > values (creation date,
    > change date, last access date..) and also
    > attributes. In the current
    > implementation, device driver code is divided into
    > two parts - one runs in
    > kernel mode and second one in user mode - they
    > communicate with each other
    > using IOCTL - most of the functionality is in user
    > mode driver which is
    > written using C++. In the user mode driver part,
    > while handling
    > 'IRP_MJ_SET_INFORMATION' and informationclass -
    > FileBAsicInformation, code
    > is getting data from the kernel mode driver and
    > accordingly populates file
    > date and attribute fields. I am assuming that data
    > available from the
    > IRP..->AssociatedIRP.SystemBuffer would have values
    > in these fields for me -
    > I suspect that this part of the code is not working
    > correctly.
    >
    > Also I tried setting those fields in
    > IRP_MJ_QUERY_INFORMATION
    > (informationclass - FileNetworkOpenInformation)
    > routine, but problem is i am
    > unable to build the program with a call to
    > KeQuerySystemTime() function -
    > its giving me link error. I wonder which library
    > will have this function and
    > also whether i can call this function from the user
    > mode driver or not.
    >
    > Thanks!
    > Devang.
    >
    >
    > -----Original Message-----
    > From: [email protected]
    > [mailto:[email protected]]On Behalf Of
    > Gurpreet Anand
    > Sent: Monday, March 06, 2000 4:50 PM
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Re: Windows NT File System Driver -
    > Creation date
    > problems
    >
    >
    > Well could'nt understand the problem thoroghly.
    > But you can do the following checklist.
    > 1. Use KeQuerySystemTime( PLARGE_INTEGER time)
    > function to get the current time.
    > 2. Are you getting a call to
    > IRP_MJ_QUERY_INFORMATION
    > while accesing network drive.
    > If yes then check out the Minor Function
    > FileNetworkOpenInformation. Fill out the fields of
    > this structure.
    > Hope it helps.
    > Gurpreet
    >
    > --- Devang Shah <[email protected]> wrote:
    > > Hi All,
    > >
    > > Currently I am involved in writing some device
    > > driver code for windows NT
    > > file systems. Driver provides additional network
    > > drive to the winnt user.
    > > Problem is - while creating a file on the new
    > > network drive, driver routine
    > > is not populating different date fields (creation
    > > date, change date, last
    > > access date, last write date). I tried setting
    > these
    > > fields while creating
    > > FCB block and populating FCB.MetaData.Created,
    > > FCB.MetaData.Change,
    > > FCB.MetaData.LastAccess, and
    > FCB.MetaData.LastWrite
    > > fields - but it does not
    > > seem to work - i am unable to figure out in which
    > > format does winnt want
    > > date fields to be populated and whether populating
    > > values while creating FCB
    > > block is a good idea or not.... was wondering if
    > > anyone has dealt with this
    > > problem before and could provide some insight.
    > >
    > > Thanks!
    > > Devang
    > >
    > >
    > >
    > >
    > > ---
    > > You are currently subscribed to ntfsd as:
    > > [email protected]
    > > To unsubscribe send a blank email to
    > > $subst('Email.Unsub')
    > >
    > >
    > __________________________________________________
    > Do You Yahoo!?
    > Talk to your friends online with Yahoo! Messenger.
    > http://im.yahoo.com
    >
    > ---
    > You are currently subscribed to ntfsd as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >
    >
    > ---
    > You are currently subscribed to ntfsd as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >
    >
    __________________________________________________
    Do You Yahoo!?
    Talk to your friends online with Yahoo! Messenger.
    http://im.yahoo.com
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA