Enumerating all volumes on windows 2000

NTFSD
1

Hi everybody,

I’m writing a FSFD to filter such that it should give access to save
specified files(like .doc, .txt, .ppt which I mentioned in
filespywin2k.inf) in specified folders. I’m using Windows2000 & Windows
IFS Kit and DDK 3790.1830 . I have used filespy sample code. I almost
developed the FD.

Problem is I have to attach all volumes without user intervention. Which
is discussed earlier but no clear solution. As the link below uses
ObReferenceObjectByName. There is a bug in that routine. Please, Can
anyone help me out.

http://www.osronline.com/showThread.cfm?link=56539

Thanks in advance.

Best Regards,
C.Ilango

2

I wonder how come you are not writing a mini-filter? This is all a breeze
and “done for you” :slight_smile:

“ilango” wrote in message news:xxxxx@ntfsd…
> Hi everybody,
>
> I’m writing a FSFD to filter such that it should give access to save
> specified files(like .doc, .txt, .ppt which I mentioned in
> filespywin2k.inf) in specified folders. I’m using Windows2000 & Windows
> IFS Kit and DDK 3790.1830 . I have used filespy sample code. I almost
> developed the FD.
>
> Problem is I have to attach all volumes without user intervention. Which
> is discussed earlier but no clear solution. As the link below uses
> ObReferenceObjectByName. There is a bug in that routine. Please, Can
> anyone help me out.
>
> http://www.osronline.com/showThread.cfm?link=56539
>
> Thanks in advance.
>
> Best Regards,
> C.Ilango
>
>
>
>
>
>
>

3

> Problem is I have to attach all volumes without user intervention. Which

is discussed earlier but no clear solution. As the link below uses
ObReferenceObjectByName. There is a bug in that routine. Please, Can
anyone help me out.

This is just another “I have written a driver and it does not work” post.
Welcome to the club.

Now seriously: If you really want someone to help, you have to provide
a description, not just “There’s a bug”. Does it crash ?
Or does is deadlock, return error status, or … ?

L.

4

C.Ilango,

In case you missed it, two weeks ago a message was posted to this list
declaring the filter manager redist for w2k is now avaliable (os needed,
w2k sp4, xpsp2, '03srv sp1, or Vista). Perhaps you should consider
rewritting this as a mini-filter. Volume attaches are pretty much
automatic (all found on driver load, and new ones loaded later get
attached automatically).

Using a minifilter would require almost no effort on your behalf
(coding) and zero effort on the user’s behalf.

MM

ilango wrote:

Hi everybody,

I’m writing a FSFD to filter such that it should give access to save
specified files(like .doc, .txt, .ppt which I mentioned in
filespywin2k.inf) in specified folders. I’m using Windows2000 &
Windows IFS Kit and DDK 3790.1830 . I have used filespy sample code. I
almost developed the FD.

Problem is I have to attach all volumes without user intervention.
Which is discussed earlier but no clear solution. As the link below
uses ObReferenceObjectByName. There is a bug in that routine. Please,
Can anyone help me out.

http://www.osronline.com/showThread.cfm?link=56539

Thanks in advance.

Best Regards,
C.Ilango

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Load as Boot driver of Filter group, then gather notifications using
IoRegisterFsRegistrationChange. This is the correct way for filters.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “ilango”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, January 19, 2006 4:09 PM
Subject: [ntfsd] Enumerating all volumes on windows 2000

> Hi everybody,
>
> I’m writing a FSFD to filter such that it should give access to save
> specified files(like .doc, .txt, .ppt which I mentioned in
> filespywin2k.inf) in specified folders. I’m using Windows2000 & Windows
> IFS Kit and DDK 3790.1830 . I have used filespy sample code. I almost
> developed the FD.
>
> Problem is I have to attach all volumes without user intervention. Which
> is discussed earlier but no clear solution. As the link below uses
> ObReferenceObjectByName. There is a bug in that routine. Please, Can
> anyone help me out.
>
> http://www.osronline.com/showThread.cfm?link=56539
>
> Thanks in advance.
>
> Best Regards,
> C.Ilango
>
>
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Thank you Ladislav. Sorry for insufficient information. I have added the
following routine in fspylib.c & called.

#if WINVER < 0x0501

NTSTATUS AttachToFileSystemByName(
PUNICODE_STRING FileSystemName
)
{
PDEVICE_OBJECT fsDeviceObject = NULL;
PDRIVER_OBJECT FsDriverObject = NULL;
NTSTATUS Status = STATUS_SUCCESS;
PNAME_CONTROL devName;
NTSTATUS status;
status = NLAllocateNameControl( &devName,
&gFileSpyNameBufferLookasideList );
// Reference object by name

if(NT_SUCCESS(Status))
{
Status = ObReferenceObjectByName(FileSystemName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
NULL,
KernelMode,
NULL,
&FsDriverObject);
}
// If success, attach to all devices owned by the file system driver
if(NT_SUCCESS(Status))
{
for(fsDeviceObject = FsDriverObject->DeviceObject;
fsDeviceObject != NULL;
fsDeviceObject = fsDeviceObject->NextDevice)
{
if(fsDeviceObject->DeviceType ==
FILE_DEVICE_CD_ROM_FILE_SYSTEM||
fsDeviceObject->DeviceType ==
FILE_DEVICE_DISK_FILE_SYSTEM||
fsDeviceObject->DeviceType ==
FILE_DEVICE_FILE_SYSTEM ||
fsDeviceObject->DeviceType ==
FILE_DEVICE_NETWORK_FILE_SYSTEM)
{
Status =
SpyAttachToFileSystemDevice(fsDeviceObject,devName);
}
}
}
// Dereference the object pointer
if(fsDeviceObject!=NULL)
ObDereferenceObject(fsDeviceObject);
return Status;
}

#endif

I got the BSOD with following error.

STOP 0x000001E ( 0xC0000005,0x804B3096,0x00000000, 0x00000068)
KMODE_EXCEPTION_NOT_HANDLED
*Address 804B3096 base at 80400000, Datestamp 384d9b17 - ntoskrnl.exe

Is that enough??

Thanks in advance
Best Regards,
C.Ilango

Ladislav Zezula wrote:

> Problem is I have to attach all volumes without user intervention.
> Which is discussed earlier but no clear solution. As the link below
> uses ObReferenceObjectByName. There is a bug in that routine. Please,
> Can anyone help me out.

This is just another “I have written a driver and it does not work” post.
Welcome to the club.

Now seriously: If you really want someone to help, you have to provide
a description, not just “There’s a bug”. Does it crash ?
Or does is deadlock, return error status, or … ?

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@srishtisoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

At 02:20 PM 1/20/2006, ilango wrote:

Thank you Ladislav. Sorry for insufficient information. I have added
the following routine in fspylib.c & called.

#if WINVER < 0x0501

NTSTATUS AttachToFileSystemByName(
PUNICODE_STRING FileSystemName
)
{
PDEVICE_OBJECT fsDeviceObject = NULL;
PDRIVER_OBJECT FsDriverObject = NULL; NTSTATUS Status =
STATUS_SUCCESS; PNAME_CONTROL devName;
NTSTATUS status;
status = NLAllocateNameControl( &devName,
&gFileSpyNameBufferLookasideList );
// Reference object by name

if(NT_SUCCESS(Status))
{
Status = ObReferenceObjectByName(FileSystemName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
NULL,
KernelMode,
NULL,
&FsDriverObject);
}
// If success, attach to all devices owned by the file system driver
if(NT_SUCCESS(Status))
{
for(fsDeviceObject = FsDriverObject->DeviceObject;
fsDeviceObject != NULL;
fsDeviceObject = fsDeviceObject->NextDevice)
{
if(fsDeviceObject->DeviceType == FILE_DEVICE_CD_ROM_FILE_SYSTEM||
fsDeviceObject->DeviceType ==
FILE_DEVICE_DISK_FILE_SYSTEM||
fsDeviceObject->DeviceType ==
FILE_DEVICE_FILE_SYSTEM ||
fsDeviceObject->DeviceType ==
FILE_DEVICE_NETWORK_FILE_SYSTEM)
{
Status = SpyAttachToFileSystemDevice(fsDeviceObject,devName);
}
}
}
// Dereference the object pointer
if(fsDeviceObject!=NULL)
ObDereferenceObject(fsDeviceObject);
return Status;
}

#endif

I got the BSOD with following error.

STOP 0x000001E ( 0xC0000005,0x804B3096,0x00000000, 0x00000068)
KMODE_EXCEPTION_NOT_HANDLED
*Address 804B3096 base at 80400000, Datestamp 384d9b17 - ntoskrnl.exe

Is that enough??

Err, no, that is not enough.

What’s the output of Windbg ?
Which line of the above code does it point to ?
Does it even point to the above code ?
Do you have Windbg ?
Do you know how to run Windbg ?

I suspect the last two question are superfluous, if you were running
Windbg with the symbol and source paths set correctly you would know
exactly where your exception occurred and why.

Please learn how to run a debugger, the turn around time on the list
taken to respond to you could have been spent learning how to attach
a remote debugger and your problem solved.

Mark

8

> I got the BSOD with following error.

Ok, so it crashes. Now get the drash dump, install Debugging Tools For
Windows, comfigure the OS symgbols and and open the crash dump in WinDbg.
Do the !analyze -v command and paste the stack trace information

L.

9

You have two “status” variables: “Status” and “status”. You have a bug in your error checking. It may not be the root of the BSOD, but it is a start.

-Ilya.

-------------- Original message --------------
From: ilango

> Thank you Ladislav. Sorry for insufficient information. I have added the
> following routine in fspylib.c & called.
>
> #if WINVER < 0x0501
>
> NTSTATUS AttachToFileSystemByName(
> PUNICODE_STRING FileSystemName
> )
> {
> PDEVICE_OBJECT fsDeviceObject = NULL;
> PDRIVER_OBJECT FsDriverObject = NULL;
> NTSTATUS Status = STATUS_SUCCESS;
> PNAME_CONTROL devName;
> NTSTATUS status;
> status = NLAllocateNameControl( &devName,
> &gFileSpyNameBufferLookasideList );
> // Reference object by name
>
>
>
>
> if(NT_SUCCESS(Status))
> {
> Status = ObReferenceObjectByName(FileSystemName,
> OBJ_CASE_INSENSITIVE,
> NULL,
> 0,
> NULL,
> KernelMode,
> NULL,
> &FsDriverObject);
> }
> // If success, attach to all devices owned by the file system driver
> if(NT_SUCCESS(Status))
> {
> for(fsDeviceObject = FsDriverObject->DeviceObject;
> fsDeviceObject != NULL;
> fsDeviceObject = fsDeviceObject->NextDevice)
> {
> if(fsDeviceObject->DeviceType ==
> FILE_DEVICE_CD_ROM_FILE_SYSTEM||
> fsDeviceObject->DeviceType ==
> FILE_DEVICE_DISK_FILE_SYSTEM||
> fsDeviceObject->DeviceType ==
> FILE_DEVICE_FILE_SYSTEM ||
> fsDeviceObject->DeviceType ==
> FILE_DEVICE_NETWORK_FILE_SYSTEM)
> {
> Status =
> SpyAttachToFileSystemDevice(fsDeviceObject,devName);
> }
> }
> }
> // Dereference the object pointer
> if(fsDeviceObject!=NULL)
> ObDereferenceObject(fsDeviceObject);
> return Status;
> }
>
> #endif
>
> I got the BSOD with following error.
>
> STOP 0x000001E ( 0xC0000005,0x804B3096,0x00000000, 0x00000068)
> KMODE_EXCEPTION_NOT_HANDLED
> *Address 804B3096 base at 80400000, Datestamp 384d9b17 - ntoskrnl.exe
>
> Is that enough??
>
> Thanks in advance
> Best Regards,
> C.Ilango
>
>
> Ladislav Zezula wrote:
>
> >> Problem is I have to attach all volumes without user intervention.
> >> Which is discussed earlier but no clear solution. As the link below
> >> uses ObReferenceObjectByName. There is a bug in that routine. Please,
> >> Can anyone help me out.
> >
> >
> > This is just another “I have written a driver and it does not work” post.
> > Welcome to the club.
> >
> > Now seriously: If you really want someone to help, you have to provide
> > a description, not just “There’s a bug”. Does it crash ?
> > Or does is deadlock, return error status, or … ?
> >
> > L.
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@srishtisoft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com