Hi,
I am writing a filter driver for NT4.0 and am having trouble when filtering
IRP_MJ_CREATE requests. I think the problem is related file caching but
I’ve no idea how to solve the problem.
If I use the following code the open fails with access denied. I can see
that the IRP_MJ_CLOSE that I was expecting when I call ZwClose isn’t
received until after the function exits.(even though I am asking for
FILE_NO_INTERMEDIATE_BUFFERING and SYNCHRONIZE).
If I set file sharing options to FILE_SHARE_READ | FILE_SHARE_WRITE |
FILE_SHARE_DELETE in my ZwCreate call. I can open the file but run into a
different problem. If someone is trys to delete a file, the delete call
seems to work but the file is left in a STATUS_DELETE_PENDING state. Again
I think it is waiting for a IRP_MJ_CLOSE.
Any enlightenment or work around would be greatly appreciated.
Thanks,
Mark.
The code follows:
NTSTATUS MyHookCreate(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
NTSTATUS ntStatus;
OBJECT_ATTRIBUTES ObjectAttributes;
IO_STATUS_BLOCK IoStatus;
PIO_STACK_LOCATION pCurrentStackLocation = NULL;
PIO_STACK_LOCATION pNextIoStackLocation = NULL;
PFILE_OBJECT pFileObject = NULL;
PHOOK_EXTENSION pDeviceExtension = NULL;
HANDLE hFile;
UNICODE_STRING ustrFullDevicePathName;
// Get basic information
pCurrentStackLocation = IoGetCurrentIrpStackLocation(pIrp);
pNextIoStackLocation = IoGetNextIrpStackLocation(pIrp);
pFileObject = pCurrentStackLocation->FileObject;
pDeviceExtension = pDeviceObject->DeviceExtension;
//Get the full device path file name from
//file object(ie. “\??\c:\temp\test.txt”)
GetFullDevicePathName(&ustrFullDevicePathName);
InitializeObjectAttributes (&ObjectAttributes, &ustrFullDevicePathName,
OBJ_CASE_INSENSITIVE,NULL,NULL);
ntStatus = ZwCreateFile(&hFile, GENERIC_READ | SYNCHRONIZE,
&ObjectAttributes, &IoStatus,NULL, 0, 0, FILE_OPEN,
FILE_NO_INTERMEDIATE_BUFFERING | FILE_NON_DIRECTORY_FILE |
FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
if(NT_SUCCESS(ntStatus))
{
ZwClose(&hFile);
}
// Copy parameters down to next level in the stack for the driver below us
*pNextIoStackLocation = *pCurrentStackLocation;
IoSetCompletionRoutine(pIrp, DefaultDispatchCompletion, NULL,
TRUE, TRUE, TRUE );
// Return the results of the call to the caller
return IoCallDriver(pDeviceExtension->FileSystem, pIrp);
}
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com