DeviceIoControl + MiniFilter

NTFSD
1

Hi I am working on a File system Minifilter,

And I want to Send custom IOCTLS from my user applications to the mini-filter,

I tried creating named devices using
IoCreateDevice(DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);

and then created a SymBolic Link for the same device:
IoCreateSymbolicLink(&dosName, &deviceName);

but when from my appliction when I try CreateFile()

CreateFile(deviceName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, NULL);

I get an errorcode 1 which means invalid function

I checked using WinObj.exe whether my object is listed or not, it seems it is listed there as well but when I try to see the properties I get the same error using WinOBj Unable to open:

Any ideas where I could be wrong:

regards
Mohan

2

xxxxx@rsystems.com wrote:

Hi I am working on a File system Minifilter,

And I want to Send custom IOCTLS from my user applications to the mini-filter,

I tried creating named devices using
IoCreateDevice(DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);

and then created a SymBolic Link for the same device:
IoCreateSymbolicLink(&dosName, &deviceName);

but when from my appliction when I try CreateFile()

CreateFile(deviceName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, NULL);

You shall use CreateFile(dosName, …) in the previous call (from the
user mode you
open the dos name, NOT the kernel mode / NT-specific name).

Sandor LUKACS
Virus Analyst, SOFTWIN

I get an errorcode 1 which means invalid function

I checked using WinObj.exe whether my object is listed or not, it seems it is listed there as well but when I try to see the properties I get the same error using WinOBj Unable to open:

Any ideas where I could be wrong:

regards
Mohan

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitdefender.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Have you looked at the CDO minifilter sample? Instead of IOCTL’s, is
there a reason you can’t communicate with
your minifilter using the regular FilterConnect… FilterSendMessage api?

xxxxx@rsystems.com wrote:

Hi I am working on a File system Minifilter,

And I want to Send custom IOCTLS from my user applications to the mini-filter,

I tried creating named devices using
IoCreateDevice(DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);

and then created a SymBolic Link for the same device:
IoCreateSymbolicLink(&dosName, &deviceName);

but when from my appliction when I try CreateFile()

CreateFile(deviceName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, NULL);

I get an errorcode 1 which means invalid function

I checked using WinObj.exe whether my object is listed or not, it seems it is listed there as well but when I try to see the properties I get the same error using WinOBj Unable to open:

Any ideas where I could be wrong:

regards
Mohan

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thanks for the suggestion my requirement is any application should be able to talk to the Minifilter not just one application which connects with the filter using communication ports.

Even using dos name also failed.

5

xxxxx@rsystems.com wrote:

Thanks for the suggestion my requirement is any application should be able to talk to the Minifilter not just one application which connects with the filter using communication ports.

Just a hint: FltCreateCommunicationPort has the /MaxConnections /parameter.
So, AFAIK you can allow multiple connection to the same port, from different
applications. This would not be a good solution for you?

Sandor LUKACS
Virus Analyst, SOFTWIN

Even using dos name also failed.

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitdefender.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Do you have implemented dispatch functions for Create, Cleanup, etc. ?

wrote news:xxxxx@ntfsd…
> Hi I am working on a File system Minifilter,
>
> And I want to Send custom IOCTLS from my user applications to the
> mini-filter,
>
> I tried creating named devices using
> IoCreateDevice(DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN,
> FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);
>
> and then created a SymBolic Link for the same device:
> IoCreateSymbolicLink(&dosName, &deviceName);
>
> but when from my appliction when I try CreateFile()
>
> CreateFile(deviceName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
> NULL, OPEN_EXISTING, 0, NULL);
>
> I get an errorcode 1 which means invalid function
>
> I checked using WinObj.exe whether my object is listed or not, it seems it
> is listed there as well but when I try to see the properties I get the
> same error using WinOBj Unable to open:
>
> Any ideas where I could be wrong:
>
>
>
>
>
>
> regards
> Mohan
>
>
>
>
>
>
>
>
>
>
>
>
>

7

Thanks for all the responses:

Actually the problem is my filter is already tightly bound with one usermode application and they use Communicate Ports for exchanging data which I don’t want to disturb:

What I wanted was that one more application could also send some messages to my mini-filter for some regular working using DeviceIoControls.

I think I have found the reason why my implementation fails as described rightly by Neal Christiansen in the following article http://www.osronline.com/showThread.cfm?link=89482
where in he suggests using CDO sample which creates a Control Device Object for private communication using IOCTLS:

What I want my filter is to provide both DeviceIoControl mechanisms as well as communication port to communicate with User mode applications:

My questions are can these two approaches co-exist and what all changes will I require to my mini-filter implementation to support both these mechanisms of communication:

Does it implies I cannot Use Filter Operation Registration (FLT_OPERATION_REGISTRATION) call-back structure in my mini-filter and have to directly manipulate DriverObject passing it address of functions which will handle IRP’s directed towards the Device Object created by my Mini-Filter.

Any help would be greatly appreciated:

regards