Hi, all
First, I want to thanks the persons for giving me lots of
advice, without your help I can’t complete my task.
Now I meet some new problems.
I’m writing a filter device to protect file.
For example:
When my Hook Routine receive IRP_WRITE, I want to copy the target file
to other place (e.g. to C:\File) before this file will be written, then
I redirect write operation to the copied file in C:\File. I do it like
this:
First, I make my own IRP to copy the target file to the new folder
(C:\File), I am sure it works well.
Second, I make my own IRP to create a file object of the copied file in
C:\File.
Then pNextIrpStack->DeviceObject=DeviceC;
pNextIrpStack->FileObject=pFileObject;
I succeed to redirect write operation for almost any files,
except when my hook routine receives an IRP_WRITE which want to write to
D:\Documents and Settings\SuperMi\ntuser.dat.LOG. After I succeed to
copy file and make a new file object, I call the lower device, then I
receive an error said:
Break due to page Fault (0Eh) Fault=0000
The stack is like this:
Ntfs!.text+0E95
Ntfs!.text+12C0
Ntfs!.text+2683
ntoskrnl!IoBuildSynchronousFsdRequest+008F
MyProgram!.text+07C9
…
When I track into Ntfs!.text+0E95, I found Ntfs call a function
named :IoSetTopLevelIrp(PIRP pIrp) , after this call , the routine jump
to handle the exception, and the error’s report appear in SoftICE.
I wonder to know where am I wrong, are there anybody can tell
me?
Thanks in advance.