File object from section object

NTFSD
1

Hi,

Does anyone know a way to obtain a file object
from a section object ?

Thanks for your help.

2

CcGetFileObjectFromSectionPtrs is the call your looking for.

Check out www.osronline.com for more explaination on this function.

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/

“Toda Florin” wrote in message
news:xxxxx@ntfsd…
>
>
> Hi,
>
> Does anyone know a way to obtain a file object
> from a section object ?
>
> Thanks for your help.
>
>
>

3

He may be asking about how to get the file object backing an arbitrary
PSECTION_OBJECT, not necessarily the file object being used by the Cache
Manager to back a particular file. In this case, there are no APIs to
give him what he wants.

Mark Cariddi wrote:

CcGetFileObjectFromSectionPtrs is the call your looking for.

Check out www.osronline.com for more explaination on this function.

–
Nick Ryan (MVP for DDK)

4

Then to elaborate on Nick’s clarification of the original question: there is
no simple mechanism for associating a section object with the controlling
file object. The data structures used within the section object are opaque
and must not be traversed outside the memory manager’s context. You MIGHT
be able to attempt a heuristic approach here, but it seems dubious at best.

Why do you want to get the file object back for the specific section?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
http://www.osronline.com

-----Original Message-----
From: Nick Ryan [mailto:xxxxx@nryan.com]
Sent: Monday, November 17, 2003 1:04 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: File object from section object

He may be asking about how to get the file object backing an arbitrary
PSECTION_OBJECT, not necessarily the file object being used by the Cache
Manager to back a particular file. In this case, there are no APIs to
give him what he wants.

Mark Cariddi wrote:

CcGetFileObjectFromSectionPtrs is the call your looking for.

Check out www.osronline.com for more explaination on this function.

–
Nick Ryan (MVP for DDK)

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Actually, I do believe there is an heuristic you could use: map the file,
mark the page as dirty, flush the file. When you see the IRP_MJ_WRITE
(IRP_PAGING_IO) then you see the file object that is backing the section.
Ugly, but it would work (even if someone else races with you and flushes
before you do - you still see that paging I/O operation.) You know it is
the same file because FileObject->SectionObjectPointers is the same for both
your file object (the one you used to map it) and the one in the
IRP_MJ_WRITE.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Monday, November 17, 2003 2:56 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: File object from section object

Then to elaborate on Nick’s clarification of the original question: there is
no simple mechanism for associating a section object with the controlling
file object. The data structures used within the section object are opaque
and must not be traversed outside the memory manager’s context. You MIGHT
be able to attempt a heuristic approach here, but it seems dubious at best.

Why do you want to get the file object back for the specific section?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
http://www.osronline.com

-----Original Message-----
From: Nick Ryan [mailto:xxxxx@nryan.com]
Sent: Monday, November 17, 2003 1:04 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: File object from section object

He may be asking about how to get the file object backing an arbitrary
PSECTION_OBJECT, not necessarily the file object being used by the Cache
Manager to back a particular file. In this case, there are no APIs to give
him what he wants.

Mark Cariddi wrote:

CcGetFileObjectFromSectionPtrs is the call your looking for.

Check out www.osronline.com for more explaination on this function.

–
Nick Ryan (MVP for DDK)

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

This will not help, it requires SECTION_OBJECT_POINTERS (i.e. the FCB) -
and not the real “section object” or “control area” structs which are
referenced by the handle which is created by ZwCreateSection/CreateFileMapping.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Mark Cariddi”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Monday, November 17, 2003 4:32 PM
Subject: [ntfsd] Re: File object from section object

> CcGetFileObjectFromSectionPtrs is the call your looking for.
>
> Check out www.osronline.com for more explaination on this function.
>
> –
> Mark Cariddi
> Consulting Associate
> OSR, Open Systems Resources, Inc.
> http://www.osr.com/
>
> “Toda Florin” wrote in message
> news:xxxxx@ntfsd…
> >
> >
> > Hi,
> >
> > Does anyone know a way to obtain a file object
> > from a section object ?
> >
> > Thanks for your help.
> >
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

7

If he’s able to map it, he could actually use the undocumented
ZwQueryVirtualMemory with the MemorySectionName category to do this.

Tony Mason wrote:

Actually, I do believe there is an heuristic you could use: map the file,
mark the page as dirty, flush the file. When you see the IRP_MJ_WRITE
(IRP_PAGING_IO) then you see the file object that is backing the section.
Ugly, but it would work (even if someone else races with you and flushes
before you do - you still see that paging I/O operation.) You know it is
the same file because FileObject->SectionObjectPointers is the same for both
your file object (the one you used to map it) and the one in the
IRP_MJ_WRITE.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Monday, November 17, 2003 2:56 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: File object from section object

Then to elaborate on Nick’s clarification of the original question: there is
no simple mechanism for associating a section object with the controlling
file object. The data structures used within the section object are opaque
and must not be traversed outside the memory manager’s context. You MIGHT
be able to attempt a heuristic approach here, but it seems dubious at best.

Why do you want to get the file object back for the specific section?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
http://www.osronline.com

-----Original Message-----
From: Nick Ryan [mailto:xxxxx@nryan.com]
Sent: Monday, November 17, 2003 1:04 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: File object from section object

He may be asking about how to get the file object backing an arbitrary
PSECTION_OBJECT, not necessarily the file object being used by the Cache
Manager to back a particular file. In this case, there are no APIs to give
him what he wants.

Mark Cariddi wrote:

>CcGetFileObjectFromSectionPtrs is the call your looking for.
>
>Check out www.osronline.com for more explaination on this function.
>

–
Nick Ryan (MVP for DDK)

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Nick Ryan (MVP for DDK)

8

Hi,

Thanks for all the ideas.
I was not so clear about my question. Indeed, I needed a
FILE_OBJECT backing an arbitrary SECTION_OBJECT.
This problem arised when I intercepted NtCreateProcessEx.
I needed the path of the executabile beeing maped into the
process address space.
I noticed that NtCreateProcessEx has as parameter a
SectionObject handle . I suspect that this section object
is backed by the file object reprezenting the executabile beeing
mapped. ( Is this a correct guess? )
I worked so far with PsSetLoadImageNotifyRoutine, but this is a
work-around.

On Mon, 17 Nov 2003, Nick Ryan wrote:

If he’s able to map it, he could actually use the undocumented
ZwQueryVirtualMemory with the MemorySectionName category to do this.

Tony Mason wrote:

> Actually, I do believe there is an heuristic you could use: map the file,
> mark the page as dirty, flush the file. When you see the IRP_MJ_WRITE
> (IRP_PAGING_IO) then you see the file object that is backing the section.
> Ugly, but it would work (even if someone else races with you and flushes
> before you do - you still see that paging I/O operation.) You know it is
> the same file because FileObject->SectionObjectPointers is the same for both
> your file object (the one you used to map it) and the one in the
> IRP_MJ_WRITE.
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: Tony Mason [mailto:xxxxx@osr.com]
> Sent: Monday, November 17, 2003 2:56 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Re: File object from section object
>
> Then to elaborate on Nick’s clarification of the original question: there is
> no simple mechanism for associating a section object with the controlling
> file object. The data structures used within the section object are opaque
> and must not be traversed outside the memory manager’s context. You MIGHT
> be able to attempt a heuristic approach here, but it seems dubious at best.
>
> Why do you want to get the file object back for the specific section?
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
> http://www.osronline.com
>
>
> -----Original Message-----
> From: Nick Ryan [mailto:xxxxx@nryan.com]
> Sent: Monday, November 17, 2003 1:04 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Re: File object from section object
>
> He may be asking about how to get the file object backing an arbitrary
> PSECTION_OBJECT, not necessarily the file object being used by the Cache
> Manager to back a particular file. In this case, there are no APIs to give
> him what he wants.
>
> Mark Cariddi wrote:
>
>
>>CcGetFileObjectFromSectionPtrs is the call your looking for.
>>
>>Check out www.osronline.com for more explaination on this function.
>>
>
>
> –
> Nick Ryan (MVP for DDK)
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>