Basic Filter driver questions

NTFSD
1

As noted in a previous question, I’m doing a minifilter activity monitor.
I’m working on getting approval to attend the Boston FS seminar, but I need
some basics answered before that.

Is there a relationship between the FO I see in a minifilter callback and
the HANDLE the UM application gets? Since my filter is currently capturing
(almost) everything, I’ve had a hard time discerning what might be different
(if anything) if an app opens the same file 5 times without closing it, for
example. I’ve done a bit of spelunking with FileTest, but I’m absolutely
sure I’ve not fully comprehended what I’m seeing.

So for my benefit, and for the benefit of the archives, which I’ve not had
complete success searching, here’s what I think is going on, please offer
corrections to the defects in understanding:

An app opens a file, the system presents an FO to the minifilter. An app
opens another handle to the same file, the system presents another FO to the
minifilter.

If an app shares a handle with another app, the FO will be the same, but the
Process ID will not.

I found a post by Aditya Shrivastava that explained the following:

FLT_STREAMHANDLE_CONTEXT corresponds to creating a context per FO.

FLT_STREAM_CONTEXT corresponds to creating a context per file stream, so
only one context, no matter how many apps open that specific file:stream.

Since I’m targeting Pre-Vista OS’es, I don’t care about FLT_FILE_CONTEXT,
but that would be one context per file, no matter how many streams the file
has.

Thanks,

Phil

Philip D. Barila (303) 776-1264

2

Hi Phil,

"An app opens a file, the system presents an FO to the minifilter. An app
opens another handle to the same file, the system presents another FO to the
minifilter.

If an app shares a handle with another app, the FO will be the same, but the
Process ID will not.

I found a post by Aditya Shrivastava that explained the following:

FLT_STREAMHANDLE_CONTEXT corresponds to creating a context per FO.

FLT_STREAM_CONTEXT corresponds to creating a context per file stream, so
only one context, no matter how many apps open that specific file:stream.

Since I’m targeting Pre-Vista OS’es, I don’t care about FLT_FILE_CONTEXT,
but that would be one context per file, no matter how many streams the file
has."

Yup, you are right about all this. You can have more than one handle for a
FO if you call DuplicateHandle (even in the same process), but otherwise the
mapping is one to one.

There is this post about how filter contexts are implemented using the
underlying file system support:
http://fsfilters.blogspot.com/2011/01/contexts-in-legacy-filters-and.html.

Thanks,

Alex.

3

This guide may be useful as well:

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/IRPs.doc

Or Google: Handling IRPs - What Every Driver Writer Needs to Know

We’ve tried attending the OSR File System seminar several times now but there hasn’t been enough interest. Hopefully this April things will go as planned and hopefully Phil, you get your approval!

Cheers!

4

Nice post Alex ( as always :slight_smile: )

@Phil Barila

Though Alex already gave the answer, I suggest trying one combination, use FileSpy along with your program (you’ll write it) which will call CreateFile and relatives to gather data. That should provide you enough data to to conclude these relations.