Call FltWriteFile in Pre-Create cause failure

NTFSD
1

In minifilter sample, I call FltCreateFile in PreCreate to create file(filename is retrieved in FltObjects passed to PreCreate routine)?then I get fileobject by returnted file handle. Code follows below,
status = FltCreateFile(FltObjects->Filter,
FltObjects->Instance,
&hFile,
uDesiredAccess,
&ob,
&IoStatus,
NULL,
uFileAttributes,
uShareAccess,
uCreateDisposition,
uCreateOptions,
NULL,
0,
IO_IGNORE_SHARE_ACCESS_CHECK
) ;
if (!NT_SUCCESS(status))
{
if (STATUS_OBJECT_NAME_NOT_FOUND == status)
FltStatus = FLT_PREOP_SUCCESS_NO_CALLBACK ;
else
FltStatus = FLT_PREOP_COMPLETE ;
__leave ;
}

status = ObReferenceObjectByHandle(hFile,
STANDARD_RIGHTS_ALL,
*IoFileObjectType,
KernelMode,
&pFileObject,
NULL
) ;
if (!NT_SUCCESS(status))
{
FltStatus = FLT_PREOP_COMPLETE ;
__leave ;
}

Then I call FltWriteFile to write a 0x1000 bytes header at beggining of the new created empty file. The status returned is STATUS_SUCCESS?but BytesReadWrite returned is still zero and currentbyteoffset in pFileObject is not changed to 0x1000. Actually, there is no byte written into the file.
status = FltWriteFile(
Instance,
pFileObject,
&ByteOffset,
Length,
Buffer,
FLTFL_IO_OPERATION_NON_CACHED|FLTFL_IO_OPERATION_PAGING,
BytesReadWrite,
NULL,NULL
);
It really confused me. Thanks for help.

2

Do not specify paging IO for your write call. Paging IO cannot extend EOF.

3

Thanks for reply, Matt.
I followed your suggestion and removed the Paging IO flag, but result is the same.

4

Can We use FltWriteFile in pre-create callback routine?
I just aligned the buffer, made the offset to multiply of sector size, as described in WDK Document, but there’s no use. The returned status is STATUS_INVALID_PARAMETER.

5

Why are you trying to do this in PreCreate? You should wait until PostCreate
when the file is created before you do this.

–
Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

wrote in message news:xxxxx@ntfsd…
> Can We use FltWriteFile in pre-create callback routine?
> I just aligned the buffer, made the offset to multiply of sector size, as
> described in WDK Document, but there’s no use. The returned status is
> STATUS_INVALID_PARAMETER.
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4342 (20090817)
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>

Information from ESET NOD32 Antivirus, version of virus signature database 4342 (20090817)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

6

I’d also take a great deal of care before I borrowed the file object from
the create.

http://www.osronline.com/article.cfm?article=219

“Don Burn” wrote in message news:xxxxx@ntfsd…
> Why are you trying to do this in PreCreate? You should wait until
> PostCreate when the file is created before you do this.
>
>
> –
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
> wrote in message news:xxxxx@ntfsd…
>> Can We use FltWriteFile in pre-create callback routine?
>> I just aligned the buffer, made the offset to multiply of sector size, as
>> described in WDK Document, but there’s no use. The returned status is
>> STATUS_INVALID_PARAMETER.
>>
>>
>> Information from ESET NOD32 Antivirus, version of virus
>> signature database 4342 (20090817)
>>
>> The message was checked by ESET NOD32 Antivirus.
>>
>> http://www.eset.com
>>
>>
>>
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4342 (20090817)
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
>
>

7

Thanks for your replies, Dorn and Rod.
I do this in pre-create for the point that I want to write a header flag into the target file, this is a ideal place(I think) to complete the task. So I create the file and reference the fileobject and write the flag. Then underlying file system just open the tagged file instead of creating it.

There is no attention description in WDK Help doc to point out FltWriteFile should not be called in Pre-Create. Need your help.

8

want to write a header flag into the target file, this is a ideal place(I think) to complete the task

hello shenhui,
with you requirements, i feel it is best to do it in post create. because still application has written nothing into it. you will achieve what you want.

even then u are so much willing to do it in pre only, pre create is not the place, and u may consider, pre write.

i dont see any reason to do it in precreate

9

what is your byteoffset, if you are doing non-cached IO than it has to be aligned. Have you tried doing cached IO, if cached IO is succeeding just check for buffer alignment, or better use cached IO if there is no real need for non-cached IO.

>I do this in pre-create for the point that I want to write a header flag into the target file, this is a ideal place(I think) to complete the task. So I create the file and reference the fileobject and write the flag.

So lets say I create a .txt file in explorer, your driver will intercept and assuming that it is working as described, it will intercept the call and put some data in the file.

Now I decide not to write anything to file, but I noticed that it is already having X bytes in it.

So are you modifying the size which user will see too?

Another thing I noticed is that, in create you create a file and write some data to it. What if the original create IRP has supersede or overwrite flag set. That will overwrite your data. So are you changing create options also?

Thanks
Aditya

10

@Rod

>I’d also take a great deal of care before I *borrowed* the file object from the create.

If possible can you please comment further on this.

I noticed OP is creating his own separate file object and than calling write on that so he is not using the original one. (in fact as it is pre-create he can not ).

So what exactly you meant when you said borrowed.

Thanks
Aditya

11

Aditya, thanks for your reply.
I do change the create option(as FILE_OPEN instead of FILE_OPEN_IF) after writing header into file.
Maybe it’s due to the filesize that I should pay more attention.