Could windows minifilter operate to disk LBA(logic block Address)?

NTFSD
1

Hi, I already know windows minifilter could use iopb->TargetFileObject
as IRP destination. Could minifilter do a more lower level of operate
IRP target? Such as write data to the LBA(logic block Address) of a
disk.

If minifilter could not solve this, which layer could do such job? Is
there any example of such staff in WDK?

Thank you.

2

Well, there are two things to consider here.

A filter in general is defined by what it filters. A file system filter filters file system operations. A storage filter filters storage level requests, a registry filters filters registry operations and so on. So if by “operate” you mean “operate as a filter” then no, a minifilter cannot operate at block level. It only receives callbacks for file system operations.

On the other hand, minifilters are kernel mode drivers so they all have the same restrictions in terms of what they can do. A minifilter can issue reads and writes in the same way and using the same mechanisms that any other driver can. So if by “operate” you mean whether it can issue reads and writes at block level then then answer is yes, a minifilter can do that, just like pretty much any other driver (it is worth mentioning that it’s also possible to issue such requests from user mode as well).

Does this answer your question ?

Thanks,
Alex.

3

Yes, Alex. I am really glad your reply!

I don’t want minifilter as filter in this case, Just like you said
whether minifilter it can issue reads and writes at block level. I
just mean that! Thank you.

What I mean is write or read file data as block to the hard disk.
Write the data to the logic block address destination, not the
filename pointer as iopb->filetarget…

So could the minifilter level (kernel level) do that, if so how, and
could you show me some example in WDK src?

Waiting for your reply! thank you.

Quoting xxxxx@gmail.com:

Well, there are two things to consider here.

A filter in general is defined by what it filters. A file system
filter filters file system operations. A storage filter filters
storage level requests, a registry filters filters registry
operations and so on. So if by “operate” you mean “operate as a
filter” then no, a minifilter cannot operate at block level. It only
receives callbacks for file system operations.

On the other hand, minifilters are kernel mode drivers so they all
have the same restrictions in terms of what they can do. A
minifilter can issue reads and writes in the same way and using the
same mechanisms that any other driver can. So if by “operate” you
mean whether it can issue reads and writes at block level then then
answer is yes, a minifilter can do that, just like pretty much any
other driver (it is worth mentioning that it’s also possible to
issue such requests from user mode as well).

Does this answer your question ?

Thanks,
Alex.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

>So could the minifilter level (kernel level) do that

Hardly ever. FltMgr as a framework is not suited for this, you need a usual WDM/KMDF driver, not a minifilter (though you can combine the 2 in the same binary).

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

5

So could you give me some WDK example to refer to?

Thank you.

Quoting “Maxim S. Shatskih” :

>> So could the minifilter level (kernel level) do that
>
> Hardly ever. FltMgr as a framework is not suited for this, you need
> a usual WDM/KMDF driver, not a minifilter (though you can combine
> the 2 in the same binary).
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>