Hi. I have build a simple file system filter based on sfilter. And it
is not surprising that is won’t work on windows 2000( but it did
surprise me ) since sfilter use IoRegisterFsRegistrationChange to
attach to all file systems.
I have tried some way to work around this, but failed.
I have tried to get the DEVICE_OBJECT of “\Ntfs”, and get the
DRIVER_OBEJCT it belongs to, then I think I can attach to all volumes
belong to the driver.
But the device object returned by IoGetDeviceObjectPointer is not the
device itself, but a filter attached to it( I don’t know who create
the filter, but should be microsoft), so the driver object of it is
not “\Filesystem\Ntfs”. And there is no way to get the “bottom
device”(the REAL “\Ntfs”) of the device statck on windows 2000.
Then I try to get the driver object named \Filestem\Ntfs, but I
can’t figure out which function can do this.I googled and found a
function ObReferenceObjectByName, but it is not declared in my ddk.
Then are there a safe way to attach to volumes on windows XP and windows 2000?
Thanks!
>Hi. I have build a simple file system filter based on sfilter. And it
is not surprising that is won’t work on windows 2000( but it did
surprise me ) since sfilter use IoRegisterFsRegistrationChange to
attach to all file systems.
SFILTER-based filters worked fine since NT4. But they must be loaded as Boot
start in “filter” group, and cannot be unloaded.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Thanks! I didn’t set correct value for “group”. I have corrected it
and now it works fine.
And what is the correct value for “Type”?
SERVICE_KERNEL_DRIVER or
SERVICE_FILE_SYSTEM_DRIVER?
2005/11/29, Maxim S. Shatskih :
> >Hi. I have build a simple file system filter based on sfilter. And it
> >is not surprising that is won’t work on windows 2000( but it did
> >surprise me ) since sfilter use IoRegisterFsRegistrationChange to
> >attach to all file systems.
>
> SFILTER-based filters worked fine since NT4. But they must be loaded as Boot
> start in “filter” group, and cannot be unloaded.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Obviously SERVICE_FILE_SYSTEM_DRIVER.
“li pan” wrote in message news:xxxxx@ntfsd…
Thanks! I didn’t set correct value for “group”. I have corrected it
and now it works fine.
And what is the correct value for “Type”?
SERVICE_KERNEL_DRIVER or
SERVICE_FILE_SYSTEM_DRIVER?
2005/11/29, Maxim S. Shatskih :
> >Hi. I have build a simple file system filter based on sfilter. And it
> >is not surprising that is won’t work on windows 2000( but it did
> >surprise me ) since sfilter use IoRegisterFsRegistrationChange to
> >attach to all file systems.
>
> SFILTER-based filters worked fine since NT4. But they must be loaded as
> Boot
> start in “filter” group, and cannot be unloaded.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>And what is the correct value for “Type”?
SERVICE_KERNEL_DRIVER or
This one.
2005/11/29, Maxim S. Shatskih :
> >Hi. I have build a simple file system filter based on sfilter. And it
> >is not surprising that is won’t work on windows 2000( but it did
> >surprise me ) since sfilter use IoRegisterFsRegistrationChange to
> >attach to all file systems.
>
> SFILTER-based filters worked fine since NT4. But they must be loaded as Boot
> start in “filter” group, and cannot be unloaded.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
2005/11/30, Maxim S. Shatskih :
> >And what is the correct value for “Type”?
> >SERVICE_KERNEL_DRIVER or
>
> This one.
>
> 2005/11/29, Maxim S. Shatskih :
> > >Hi. I have build a simple file system filter based on sfilter. And it
> > >is not surprising that is won’t work on windows 2000( but it did
> > >surprise me ) since sfilter use IoRegisterFsRegistrationChange to
> > >attach to all file systems.
> >
> > SFILTER-based filters worked fine since NT4. But they must be loaded as Boot
> > start in “filter” group, and cannot be unloaded.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>