Attributes

How do I get file attributes while opening file with my filter driver.

Thanks
Ramaraj


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> How do I get file attributes while opening file with my filter driver.

When you open it via ZwCreateFile or after your driver gets an
IRP_MJ_CREATE targeted to lower driver?
I suppose the second-:wink:
After the create succeeds, send a Query Irp with class
FileBasicInformation or FileStandardInformation (one of these contains
attributes, I don’t recall which). That’s it.
I never did this in IRP_MJ_CREATE (I only did it in
IRP_MJ_SET_INFROMATION), so I don’t know if it would cause a deadlock in
certain cases, like query in a close, paged read/write or stream cleanup
on NTFS can.
BTW, please, don’t post in HTML - not everyone can read such a
message.


Kind regards, Dejan M. CEO Alfa Co. www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@ptt.yu, xxxxx@register.co.yu and
xxxxx@alfaunits.co.yu
ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa File Protector - #1 file protection and hiding system for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Using FileObject->FileName in filter driverCurrentStackLocation.Parameters.Create.FileAttributes

Regards,
Satish K.S

----- Original Message -----
From: Ramaraj Pandian
To: File Systems Developers
Sent: Wednesday, May 09, 2001 5:55 AM
Subject: [ntfsd] Attributes

How do I get file attributes while opening file with my filter driver.

Thanks
Ramaraj


You are currently subscribed to ntfsd as: xxxxx@aalayance.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

case IRP_MJ_READ:
if( (QueryFile(DevExt->FileSystem, FileObject,
FileBasicInformation,
&file_basic_info, sizeof(FILE_BASIC_INFORMATION))) )

{
if(file_basic_info.FileAttributes &
FILE_ATTRIBUTE_SPARSE_FILE)
{

}
}
The above one is intended for avoiding user to open files on particular
directory, later on it will be rerouted to other drive using reparsing.
First of all I don’t know the above procedure is correct, I assume that
IRP_MJ_READ is called only when double click on file or opening with
applications.
QueryFile creates its own IRP and passes to lower driver.
This seem to work fine sometime. Sometimes it gives the following error.

*** Fatal System Error: 0x00000024
(0x00190256,0xBF26CD84,0xBF26C9DC,0xBFF339A0)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***
Bugcheck code 00000024
Arguments 00190256 bf26cd84 bf26c9dc bff339a0

ChildEBP RetAddr Args to Child
bf26c4f0 8042bcb9 00000003 bf26c538 00190256
ntoskrnl!RtlpBreakWithStatusInstruction
bf26c520 8042c068 00000003 c0000005 bf26cf3c
ntoskrnl!KiBugCheckDebugBreak+0x31
bf26c8a8 bff0fe14 00000000 00190256 bf26cd84 ntoskrnl!KeBugCheckEx+0x37b
c0000188 00000000 00000000 00000000 00000000 Ntfs!NtfsRaiseStatus+0x32c2

Thanks for your help
Ramaraj

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@ptt.yu]
Sent: Tuesday, May 08, 2001 6:14 PM
To: File Systems Developers
Subject: [ntfsd] Re: Attributes

How do I get file attributes while opening file with my filter driver.

When you open it via ZwCreateFile or after your driver gets an
IRP_MJ_CREATE targeted to lower driver?
I suppose the second-:wink:
After the create succeeds, send a Query Irp with class
FileBasicInformation or FileStandardInformation (one of these contains
attributes, I don’t recall which). That’s it.
I never did this in IRP_MJ_CREATE (I only did it in
IRP_MJ_SET_INFROMATION), so I don’t know if it would cause a deadlock in
certain cases, like query in a close, paged read/write or stream cleanup
on NTFS can.
BTW, please, don’t post in HTML - not everyone can read such a
message.


Kind regards, Dejan M. CEO Alfa Co. www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@ptt.yu, xxxxx@register.co.yu and
xxxxx@alfaunits.co.yu
ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa File Protector - #1 file protection and hiding system for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.


You are currently subscribed to ntfsd as: xxxxx@dvdjukebox.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Never mind, looks like I have to check flags like (Irp->Flags &
IRP_READ_OPERATION) before querying file
Thanks
Ramaraj

-----Original Message-----
From: Ramaraj Pandian [mailto:xxxxx@dvdjukebox.com]
Sent: Wednesday, May 09, 2001 11:23 AM
To: File Systems Developers
Subject: [ntfsd] Re: Attributes

case IRP_MJ_READ:
if( (QueryFile(DevExt->FileSystem, FileObject,
FileBasicInformation,
&file_basic_info, sizeof(FILE_BASIC_INFORMATION))) )

{
if(file_basic_info.FileAttributes &
FILE_ATTRIBUTE_SPARSE_FILE)
{

}
}
The above one is intended for avoiding user to open files on particular
directory, later on it will be rerouted to other drive using reparsing.
First of all I don’t know the above procedure is correct, I assume that
IRP_MJ_READ is called only when double click on file or opening with
applications.
QueryFile creates its own IRP and passes to lower driver.
This seem to work fine sometime. Sometimes it gives the following error.

*** Fatal System Error: 0x00000024
(0x00190256,0xBF26CD84,0xBF26C9DC,0xBFF339A0)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***
Bugcheck code 00000024
Arguments 00190256 bf26cd84 bf26c9dc bff339a0

ChildEBP RetAddr Args to Child
bf26c4f0 8042bcb9 00000003 bf26c538 00190256
ntoskrnl!RtlpBreakWithStatusInstruction
bf26c520 8042c068 00000003 c0000005 bf26cf3c
ntoskrnl!KiBugCheckDebugBreak+0x31
bf26c8a8 bff0fe14 00000000 00190256 bf26cd84 ntoskrnl!KeBugCheckEx+0x37b
c0000188 00000000 00000000 00000000 00000000 Ntfs!NtfsRaiseStatus+0x32c2

Thanks for your help
Ramaraj

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@ptt.yu]
Sent: Tuesday, May 08, 2001 6:14 PM
To: File Systems Developers
Subject: [ntfsd] Re: Attributes

How do I get file attributes while opening file with my filter driver.

When you open it via ZwCreateFile or after your driver gets an
IRP_MJ_CREATE targeted to lower driver?
I suppose the second-:wink:
After the create succeeds, send a Query Irp with class
FileBasicInformation or FileStandardInformation (one of these contains
attributes, I don’t recall which). That’s it.
I never did this in IRP_MJ_CREATE (I only did it in
IRP_MJ_SET_INFROMATION), so I don’t know if it would cause a deadlock in
certain cases, like query in a close, paged read/write or stream cleanup
on NTFS can.
BTW, please, don’t post in HTML - not everyone can read such a
message.


Kind regards, Dejan M. CEO Alfa Co. www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@ptt.yu, xxxxx@register.co.yu and
xxxxx@alfaunits.co.yu
ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa File Protector - #1 file protection and hiding system for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.


You are currently subscribed to ntfsd as: xxxxx@dvdjukebox.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@dvdjukebox.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I don’t know why you are crashing, but you have a pretty good lead
with that stop code. Parameters 2 and 3 are an exception record and a
context record respectively. Use .exr to get the details of the exception
that NTFS caught. Use .cxr to load the context when the
crash occured. From there, get a stack dump. This should give a good clue
as to what went wrong and why. If you still can’t figure it out, you might
want to post the the dump of the exception record and a stack dump in the
original context to the list.
One thing I don’t see in your code snippet is any conditional logic
checking to see if the read is a paging IO read.

-----Original Message-----
From: Ramaraj Pandian [mailto:xxxxx@dvdjukebox.com]
Sent: Wednesday, May 09, 2001 2:23 PM
To: File Systems Developers
Subject: [ntfsd] Re: Attributes

case IRP_MJ_READ:
if( (QueryFile(DevExt->FileSystem, FileObject,
FileBasicInformation,
&file_basic_info, sizeof(FILE_BASIC_INFORMATION))) )

{
if(file_basic_info.FileAttributes &
FILE_ATTRIBUTE_SPARSE_FILE)
{
---------
}
}
The above one is intended for avoiding user to open files on particular
directory, later on it will be rerouted to other drive using reparsing.
First of all I don’t know the above procedure is correct, I assume that
IRP_MJ_READ is called only when double click on file or opening with
applications.
QueryFile creates its own IRP and passes to lower driver.
This seem to work fine sometime. Sometimes it gives the following error.

Fatal System Error: 0x00000024
(0x00190256,0xBF26CD84,0xBF26C9DC,0xBFF339A0)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.





Bugcheck Analysis



******
***
Bugcheck code 00000024
Arguments 00190256 bf26cd84 bf26c9dc bff339a0

ChildEBP RetAddr Args to Child
bf26c4f0 8042bcb9 00000003 bf26c538 00190256
ntoskrnl!RtlpBreakWithStatusInstruction
bf26c520 8042c068 00000003 c0000005 bf26cf3c
ntoskrnl!KiBugCheckDebugBreak+0x31
bf26c8a8 bff0fe14 00000000 00190256 bf26cd84 ntoskrnl!KeBugCheckEx+0x37b
c0000188 00000000 00000000 00000000 00000000 Ntfs!NtfsRaiseStatus+0x32c2

Thanks for your help
Ramaraj

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@ptt.yu]
Sent: Tuesday, May 08, 2001 6:14 PM
To: File Systems Developers
Subject: [ntfsd] Re: Attributes

> How do I get file attributes while opening file with my filter driver.

When you open it via ZwCreateFile or after your driver gets an
IRP_MJ_CREATE targeted to lower driver?
I suppose the second-:wink:
After the create succeeds, send a Query Irp with class
FileBasicInformation or FileStandardInformation (one of these contains
attributes, I don’t recall which). That’s it.
I never did this in IRP_MJ_CREATE (I only did it in
IRP_MJ_SET_INFROMATION), so I don’t know if it would cause a deadlock in
certain cases, like query in a close, paged read/write or stream cleanup
on NTFS can.
BTW, please, don’t post in HTML - not everyone can read such a
message.


Kind regards, Dejan M. CEO Alfa Co. www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@ptt.yu, xxxxx@register.co.yu and
xxxxx@alfaunits.co.yu
ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa File Protector - #1 file protection and hiding system for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.


You are currently subscribed to ntfsd as: xxxxx@dvdjukebox.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com