hello everybody,
i want to capture all irps comming to file system driver. for that i have written filter driver and now i want to insert it above file system driver. for that i require pointer to target drivers device object ie. of file system driver.i used IoGetDeviceObjectPointer function for that. One of the parameter in that function is device object name. now i m not getting in which format should i give that name…explanation with example will help me a lot.
thanking you in advance.
First of all - look at examples from IFSDK/WDK for file system filters(
there are two types of filters - old style filters using attaching and
minifilters ). There are a lot of examples how to attach filters in
IFSDK/WDK( i.e. attaching when mounting, attaching by FSD’s objects
enumeration etc.). Generally speaking, there are two cases - the first when
your filter is loaded before a file system driver’s object is mounted and
the second when it is loaded after the file system driver’s object has been
mounted. Also, remeber that the system uses Volume Parameter Block to mount
a file system driver object to volume object.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> hello everybody,
>
> i want to capture all irps comming to file system
> driver. for that i have written filter driver and now i want to insert it
> above file system driver. for that i require pointer to target drivers
> device object ie. of file system driver.i used IoGetDeviceObjectPointer
> function for that. One of the parameter in that function is device object
> name. now i m not getting in which format should i give that
> name…explanation with example will help me a lot.
> thanking you in advance.
>
The correct way of attaching to FSDs this way is using
IoRegisterFsRegistrationChange and filtering mounts, as it was in SFILTER
sample.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntfsd…
> hello everybody,
>
> i want to capture all irps comming to file system
driver. for that i have written filter driver and now i want to insert it above
file system driver. for that i require pointer to target drivers device object
ie. of file system driver.i used IoGetDeviceObjectPointer function for that.
One of the parameter in that function is device object name. now i m not
getting in which format should i give that name…explanation with example will
help me a lot.
> thanking you in advance.
>