Determining in Usermode if a filter driver is providing reparsing

NTFSD
1

Hey guys,

During the plugfest I came across an interesting situation dealing with drivers who are above me that are doing reparsing. I would like to be able to, from usermode, be able to determine if any driver is reparsing paths. Does anyone know if this can be done? If so, any recommendation for reading on how to accomplish this? I basically would like to enumerate through the list of registered drivers and simply determine if they support REPARSE, so I can trigger something during installation.

Anyone have any ideas?

–
Regards,
Dana Epp
[Blog: http://silverstr.ufies.org/blog/]

2

Reparsing cannot be detected in user mode, if the
driver does not have a native support for it
(e.g. I can imagine sending a log information to the event log)

The only way I see is to attach a filter to the top of stack
and watch for STATUS_REPARSE, but this will
not catch reparsing in drivers loaded later (drivers above you,
as you wrote).

IMHO reparsing ends in the I/O manager, which will just
send another object to the same or another device.

L.