Forest for the Trees…
Suppose for the sake of defenestration I have a minifilter called
BlackHole that will respond to all Pre-functions that a Minifilter can
hook, and does nothing but return the most basic information to the I/O
manager which is needed to satisify and create the appearance that the
Volume being minifiltered is completely empty, containing no files,
creating the appearance of an empty volume Entirely from within the
minifilters doing.
Now, using FltGetVolumeFromName() / FltAttachVolume() to attach this
minifilter from within the minifilter’s own DriverEntry, I want to
“make appear” out of nowhere a new-and-non-physically-existant Volume
[drive letter] to attach my BlackHole minifilter to it’s IRP stack via
minifilter manager.
From usermode I want a driveletter to appear just as though a new
physical device was added, But with all
access to this volume being serviced entirely from the minifilter.
What is the most simple way for this to happen.
If the minifilter is doing all the responding to the I/O manager (making
the appearance of an empty disk), Does there need to be a Filesystem
device object proper on the IRP stack at all? Does it need to be there
for the mini-filter manager to attach on top of?
Why can I not just create a Device Object and tell I/O manager to route
certain paths to it(and have the minifilter intercept them)? (Why) Do I
need to go through PnP? Where does a (new) IRP stack start to be
created, on the Physical device object? If the minifilter is handling
all the “filesystem-ish” details via the pre-callbacks, Cant I get away
with no functional object? What’s going on in this mess?
Something is just not Geling, I am missing some conceptual piece in the
whole view. It must be right in front of me, but I’m just not seeing the
Forest for the Trees are all in the way.
Please slather with vehement enlightenment.
–joe
Joe,
Are you saying that you have tried this (create a device object in DriverEntry, add a symbolic link to it to create the DOS device, register the new device object as a filesystem and then let minifilter attach) and it didn’t work ? Or are you asking whether it will work?
If the former it would be interesting to know what you are seeing, if the latter my guess is that it should work.
FWIW, I think you would be much, much easier to write a complete filesystem, particularly when you come to things like file system caching. Others have said, and I’d heartily agree, that ijn the long run writing a filesystem is easier than writing a filter - you are in control rather than being involved at the edges.
Rod
Steading System Software
“Kozak, Joe” wrote in message news:xxxxx@ntfsd…
Forest for the Trees…
Suppose for the sake of defenestration I have a minifilter called BlackHole that will respond to all Pre-functions that a Minifilter can hook, and does nothing but return the most basic information to the I/O manager which is needed to satisify and create the appearance that the Volume being minifiltered is completely empty, containing no files, creating the appearance of an empty volume Entirely from within the minifilters doing.
Now, using FltGetVolumeFromName() / FltAttachVolume() to attach this minifilter from within the minifilter’s own DriverEntry, I want to “make appear” out of nowhere a new-and-non-physically-existant Volume [drive letter] to attach my BlackHole minifilter to it’s IRP stack via minifilter manager.
From usermode I want a driveletter to appear just as though a new physical device was added, But with all
access to this volume being serviced entirely from the minifilter.
What is the most simple way for this to happen.
If the minifilter is doing all the responding to the I/O manager (making the appearance of an empty disk), Does there need to be a Filesystem device object proper on the IRP stack at all? Does it need to be there for the mini-filter manager to attach on top of?
Why can I not just create a Device Object and tell I/O manager to route certain paths to it(and have the minifilter intercept them)? (Why) Do I need to go through PnP? Where does a (new) IRP stack start to be created, on the Physical device object? If the minifilter is handling all the “filesystem-ish” details via the pre-callbacks, Cant I get away with no functional object? What’s going on in this mess?
Something is just not Geling, I am missing some conceptual piece in the whole view. It must be right in front of me, but I’m just not seeing the Forest for the Trees are all in the way.
Please slather with vehement enlightenment.
–joe