close/reopen a file

NTFSD
1

I’m having a problem with my minifilter: When I get a read, I pend the
IRP, alter the file in a userland service, then allow the processing to
continue down the stack. When I hit NTFS, however, a
STATUS_INVALID_DEVICE_REQUEST comes back up. From the testing I’ve
done, it looks as though something is out of sync somewhere (not very
helpful, I know). Another process can open and read the file without
difficulty before I let the processing of the IRP continue.

If, for some reason, I can’t get things synced back up, is it possible
to reopen the file in the driver and redirect the reads/writes to it?
This doesn’t really seem like the best approach, but I’m not finding
much documentation about how I might go about getting the driver to see
the changes.

~Eric

2

You can do this, but it is a large amount of work. Basically, you have to
create a secondary file object and then manage all calls to the file system
yourself, i.e. you own the user file objects, and they point to your file
object that manages the file.

Try to find what you are doing wrong, it will be easier.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Eric Diven” wrote in message news:xxxxx@ntfsd…
If, for some reason, I can’t get things synced back up, is it possible
to reopen the file in the driver and redirect the reads/writes to it?
This doesn’t really seem like the best approach, but I’m not finding
much documentation about how I might go about getting the driver to see
the changes.

3

Thanks Don, I was kind of afraid that’s what the answer would be :wink:
Unfortunately, I’m running out of ideas to try as far as finding the
problem is concerned. The sum total of the feedback I get is the bad
NTSTATUS value.

Interestingly though, on a whim, I tried opening with notepad instead of
copy, and it issues a QUERY_VOLUME_INFORMATION (which I’m NOT currently
catching and restoring on) and I see the same error. It would seem as
though it’s a matter of how the reparse point handling is done.
Currently the userland service removes the reparse point from the file
after it’s done restoring. Would I need to do something special to get
the reparse point removal to be seen on an already open file?
Alternately, is there a reason I should be doing it in the driver anyway
that would fix the problem?

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Tuesday, September 25, 2007 11:37 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] close/reopen a file

You can do this, but it is a large amount of work. Basically, you have
to create a secondary file object and then manage all calls to the file
system yourself, i.e. you own the user file objects, and they point to
your file object that manages the file.

Try to find what you are doing wrong, it will be easier.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Eric Diven” wrote in message
news:xxxxx@ntfsd…
If, for some reason, I can’t get things synced back up, is it possible
to reopen the file in the driver and redirect the reads/writes to it?
This doesn’t really seem like the best approach, but I’m not finding
much documentation about how I might go about getting the driver to see
the changes.

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I just had a thought on this issue. In the create, I’m not reissuing
the create with FILE_OPEN_REPARSE_POINT set, and I’m wondering if I
ought to be. This is the example given for FltReissueSynchronousIo, and
I’m wondering if this is a reasonable solution to the problem. I’m
planning to catch anything that requires actual processing of the
reparse point. I’m wondering if the reparseness (please pardon my abuse
of English here) of the handle is unchangeable after creation time.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Tuesday, September 25, 2007 12:11 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] close/reopen a file

Thanks Don, I was kind of afraid that’s what the answer would be :wink:
Unfortunately, I’m running out of ideas to try as far as finding the
problem is concerned. The sum total of the feedback I get is the bad
NTSTATUS value.

Interestingly though, on a whim, I tried opening with notepad instead of
copy, and it issues a QUERY_VOLUME_INFORMATION (which I’m NOT currently
catching and restoring on) and I see the same error. It would seem as
though it’s a matter of how the reparse point handling is done.
Currently the userland service removes the reparse point from the file
after it’s done restoring. Would I need to do something special to get
the reparse point removal to be seen on an already open file?
Alternately, is there a reason I should be doing it in the driver anyway
that would fix the problem?

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Tuesday, September 25, 2007 11:37 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] close/reopen a file

You can do this, but it is a large amount of work. Basically, you have
to create a secondary file object and then manage all calls to the file
system yourself, i.e. you own the user file objects, and they point to
your file object that manages the file.

Try to find what you are doing wrong, it will be easier.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Eric Diven” wrote in message
news:xxxxx@ntfsd…
If, for some reason, I can’t get things synced back up, is it possible
to reopen the file in the driver and redirect the reads/writes to it?
This doesn’t really seem like the best approach, but I’m not finding
much documentation about how I might go about getting the driver to see
the changes.

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com