duplicate callbackdata and file object in pre-create of mini-filter

NTFSD
1

Hi,

In my pre-create routine, I need to get some file attribute data before pass
down or reject the CREATE request. If I can directly copy the callback-data
and file object, then call FltPerformSynchronousIo, the performance should
be better than calling FltCreateFileEx. Because calling FltCreateFileEx
needs to compose a file path, initialize file attributes and set other
create options, which eventually causes other operations such as parsing the
file path again. Has someone already done this successfully? Any comment is
appreciated.

Shangwu

2

The FltPerformSynchronousIo will fail. The operations you can use with
FltPerformXXXIo are:

IRP_MJ_CLOSE
IRP_MJ_CLEANUP
IRP_MJ_QUERY_SECURITY
IRP_MJ_QUERY_VOLUME_INFORMATION
IRP_MJ_SET_VOLUME_INFORMATION
IRP_MJ_QUERY_INFORMATION
IRP_MJ_SET_INFORMATION
IRP_MJ_DIRECTORY_CONTROL
IRP_MJ_READ
IRP_MJ_WRITE
IRP_MJ_FLUSH_BUFFERS
IRP_MJ_SHUTDOWN
IRP_MJ_POWER
IRP_MJ_FILE_SYSTEM_CONTROL - with IRP_MN_USER_FS_REQUEST,
IRP_MN_KERNEL_CALL, IRP_MN_LOAD_FILE_SYSTEM
IRP_MJ_DEVICE_CONTROL
IRP_MJ_INTERNAL_DEVICE_CONTROL

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Shangwu” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> In my pre-create routine, I need to get some file attribute data before
> pass down or reject the CREATE request. If I can directly copy the
> callback-data and file object, then call FltPerformSynchronousIo, the
> performance should be better than calling FltCreateFileEx. Because calling
> FltCreateFileEx needs to compose a file path, initialize file attributes
> and set other create options, which eventually causes other operations
> such as parsing the file path again. Has someone already done this
> successfully? Any comment is appreciated.
>
> Shangwu
>
>