Can I overwrite the current opened file?

NTFSD
1

Hello,

Here is the scenario for my question.

  1. An user mode program archives a local file to another location and
    replaces the local file by a stub file that points (keeps the the target
    path) to the target file.
  2. A filter driver will intercept the IRP_MJ_CREATE when the user accesses
    the stub file.
  3. The filter driver uses an inverted call service to overwrite the stub
    file by the target file.

It seems the user mode service program cannot overwrite the stub file
because it is opened now. Can the filter driver overwrite the stub file
without cancel the original request?

Regards,

Shangwu

2

Shangwu,

How is the file open? If in Step (2) you intercept the IRP_MJ_CREATE
BEFORE the open is sent to the underlying file system, the file is not
yet open. What you would do then is test to see if it exists and if it
is your stub file have your UM service replace it with the original
file. Then let the original IRP_MJ_CREATE proceed.

I suppose you could do it by cancelling the original open (e.g., after
completion is successful for the IRP_MJ_CREATE you are intercepting)
then allowing your UM service to replace the file and then re-sending
the IRP_MJ_CREATE on the file. That seems to be workable as all.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Friday, February 13, 2004 4:19 PM
To: ntfsd redirect
Subject: [ntfsd] Can I overwrite the current opened file?

Hello,

Here is the scenario for my question.

  1. An user mode program archives a local file to another location and
    replaces the local file by a stub file that points (keeps the the target
    path) to the target file.
  2. A filter driver will intercept the IRP_MJ_CREATE when the user
    accesses the stub file.
  3. The filter driver uses an inverted call service to overwrite the stub
    file by the target file.

It seems the user mode service program cannot overwrite the stub file
because it is opened now. Can the filter driver overwrite the stub file
without cancel the original request?

Regards,

Shangwu

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

Hi Tony,

Thank you for reply. I also appreciate your Inverted-Call sample on your OSR
web site. In my case the stub file is firstly opened by the drivers under my
filter. Because it is a reparse point file, the under driver returned
STATUS_REPARSE with an incomplete FileObject to my completion routine. I
guess the under driver closed the file again after it found that this file
needs to be reparsed.
Before my filter driver completes the IRP with STATUS_REPARSE, the user-mode
service is called. The service program gets failed when it copies another
file to this stub file using CopyFile().
The canceling option is not preferable in this case. Because the end user
will receive an error message if the original IRP_MJ_CREATE request is
cancelled. Is there any simple way to overwrite the stub file?

Best regards,

Shangwu

“Tony Mason” wrote in message news:xxxxx@ntfsd…
Shangwu,

How is the file open? If in Step (2) you intercept the IRP_MJ_CREATE
BEFORE the open is sent to the underlying file system, the file is not
yet open. What you would do then is test to see if it exists and if it
is your stub file have your UM service replace it with the original
file. Then let the original IRP_MJ_CREATE proceed.

I suppose you could do it by cancelling the original open (e.g., after
completion is successful for the IRP_MJ_CREATE you are intercepting)
then allowing your UM service to replace the file and then re-sending
the IRP_MJ_CREATE on the file. That seems to be workable as all.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Friday, February 13, 2004 4:19 PM
To: ntfsd redirect
Subject: [ntfsd] Can I overwrite the current opened file?

Hello,

Here is the scenario for my question.
1. An user mode program archives a local file to another location and
replaces the local file by a stub file that points (keeps the the target
path) to the target file.
2. A filter driver will intercept the IRP_MJ_CREATE when the user
accesses the stub file.
3. The filter driver uses an inverted call service to overwrite the stub
file by the target file.

It seems the user mode service program cannot overwrite the stub file
because it is opened now. Can the filter driver overwrite the stub file
without cancel the original request?

Regards,

Shangwu

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

4

Please ignore the previous message. I specified a wrong file name for
CopyFile() call. Actually it is successful if I specify a correct format of
file name.

Thank you all,

Shangwu

“Shangwu” wrote in message news:xxxxx@ntfsd…
> Hi Tony,
>
> Thank you for reply. I also appreciate your Inverted-Call sample on your
OSR
> web site. In my case the stub file is firstly opened by the drivers under
my
> filter. Because it is a reparse point file, the under driver returned
> STATUS_REPARSE with an incomplete FileObject to my completion routine. I
> guess the under driver closed the file again after it found that this file
> needs to be reparsed.
> Before my filter driver completes the IRP with STATUS_REPARSE, the
user-mode
> service is called. The service program gets failed when it copies another
> file to this stub file using CopyFile().
> The canceling option is not preferable in this case. Because the end user
> will receive an error message if the original IRP_MJ_CREATE request is
> cancelled. Is there any simple way to overwrite the stub file?
>
> Best regards,
>
> Shangwu
>
> “Tony Mason” wrote in message news:xxxxx@ntfsd…
> Shangwu,
>
> How is the file open? If in Step (2) you intercept the IRP_MJ_CREATE
> BEFORE the open is sent to the underlying file system, the file is not
> yet open. What you would do then is test to see if it exists and if it
> is your stub file have your UM service replace it with the original
> file. Then let the original IRP_MJ_CREATE proceed.
>
> I suppose you could do it by cancelling the original open (e.g., after
> completion is successful for the IRP_MJ_CREATE you are intercepting)
> then allowing your UM service to replace the file and then re-sending
> the IRP_MJ_CREATE on the file. That seems to be workable as all.
>
> Regards,
>
> Tony
>
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
> Sent: Friday, February 13, 2004 4:19 PM
> To: ntfsd redirect
> Subject: [ntfsd] Can I overwrite the current opened file?
>
> Hello,
>
> Here is the scenario for my question.
> 1. An user mode program archives a local file to another location and
> replaces the local file by a stub file that points (keeps the the target
> path) to the target file.
> 2. A filter driver will intercept the IRP_MJ_CREATE when the user
> accesses the stub file.
> 3. The filter driver uses an inverted call service to overwrite the stub
> file by the target file.
>
> It seems the user mode service program cannot overwrite the stub file
> because it is opened now. Can the filter driver overwrite the stub file
> without cancel the original request?
>
> Regards,
>
> Shangwu
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
> send a blank email to xxxxx@lists.osr.com
>
>
>