FileSystemFilterDriver - Filemon and notepad

NTFSD
1

Hi all.
I’m a newbe here…

Anyway,
I’m currently trying to write a filesystem filter driver.

In order to check it, I’ve tried some Win32 API file functions that seem to
work fine.
But
I’m having problems when trying to open a file with notepad.
It simply does not run any IRP_MJ_READ requests.
(Fast IO is disabled)

When I tried to run filemon to check what IRP’s notepad issues,
I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but files
where successfully opened with
their content.

Any explanation for that ?

Thanks,
Nir

2

Notepad does not use read and write, it uses memory mapping. You are
missing the read/write operations - they DO occur, but the manner in which
they occur is a bit more complex (they may use a DIFFERENT file object for
various implementation/technical reasons.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Nir Livni [mailto:xxxxx@cyber-ark.com]
Sent: Sunday, September 22, 2002 8:48 AM
To: File Systems Developers
Subject: [ntfsd] FileSystemFilterDriver - Filemon and notepad

Hi all.
I’m a newbe here…

Anyway,
I’m currently trying to write a filesystem filter driver.

In order to check it, I’ve tried some Win32 API file functions that seem to
work fine.
But
I’m having problems when trying to open a file with notepad.
It simply does not run any IRP_MJ_READ requests.
(Fast IO is disabled)

When I tried to run filemon to check what IRP’s notepad issues,
I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but files
where successfully opened with
their content.

Any explanation for that ?

Thanks,
Nir

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

3

Is it a different kind of IRP ? What should I look for ?

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Sunday, September 22, 2002 5:08 PM
To: File Systems Developers
Subject: [ntfsd] RE: FileSystemFilterDriver - Filemon and notepad

Notepad does not use read and write, it uses memory mapping. You are
missing the read/write operations - they DO occur, but the manner in which
they occur is a bit more complex (they may use a DIFFERENT file object for
various implementation/technical reasons.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Nir Livni [mailto:xxxxx@cyber-ark.com]
Sent: Sunday, September 22, 2002 8:48 AM
To: File Systems Developers
Subject: [ntfsd] FileSystemFilterDriver - Filemon and notepad

Hi all.
I’m a newbe here…

Anyway,
I’m currently trying to write a filesystem filter driver.

In order to check it, I’ve tried some Win32 API file functions that seem to
work fine.
But
I’m having problems when trying to open a file with notepad.
It simply does not run any IRP_MJ_READ requests.
(Fast IO is disabled)

When I tried to run filemon to check what IRP’s notepad issues,
I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but files
where successfully opened with
their content.

Any explanation for that ?

Thanks,
Nir

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@cyber-ark.com
To unsubscribe send a blank email to %%email.unsub%%

4

What do you mean by 'disabled"? Do you mean that you return FALSE on
“isfastiopossible”? If so, this is not accurate, you need to handle each
and every fastio and return FALSE for each one to ensure that you are
disabling it; and some you can not disable; such as fastiodetachdevice.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Nir Livni
Sent: Sunday, September 22, 2002 5:48 AM
To: File Systems Developers
Subject: [ntfsd] FileSystemFilterDriver - Filemon and notepad

Hi all.
I’m a newbe here…

Anyway,
I’m currently trying to write a filesystem filter driver.

In order to check it, I’ve tried some Win32 API file functions that seem
to
work fine.
But
I’m having problems when trying to open a file with notepad.
It simply does not run any IRP_MJ_READ requests.
(Fast IO is disabled)

When I tried to run filemon to check what IRP’s notepad issues,
I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but
files
where successfully opened with
their content.

Any explanation for that ?

Thanks,
Nir

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

5

I believe the reason people don’t see these is that they’re relying on
Filemon’s way of retrieving the file name - which isn’t correctly coded.
Namely, the order in which the options are checked is incorrect.
Rewrite the file name algorithm yourself, and you will see the
reads/writes. They certainly don’t disappear:-)

Regards, Dejan.

Nir Livni wrote:

Hi all.
I’m a newbe here…

Anyway,
I’m currently trying to write a filesystem filter driver.

In order to check it, I’ve tried some Win32 API file functions that seem to
work fine.
But
I’m having problems when trying to open a file with notepad.
It simply does not run any IRP_MJ_READ requests.
(Fast IO is disabled)

When I tried to run filemon to check what IRP’s notepad issues,
I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but files
where successfully opened with
their content.

Any explanation for that ?

Thanks,
Nir

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.

6

As Jamey Kirby said disabling FastIo is NOT a good idea. All the file
systems released by Microsoft implement it and if your filter doesn’t, you
will have problems. It is not that hard to implement, so why not do it? If
you get a FastIo read or write just pass it on because the file systems just
have their entry points redirected to the cache manager. If the cache
manager doesn’t have the data available, it will do one of two things: 1)
if the FastIo said it can wait it will usually just issue a standard IRP set
up as a caching IO. 2) if the request can’t wait, it will return an error
to make the caller issue a standard IRP without any caching IO bits set.

Are you attempting to implement this without having the NT4 DDK, W2K DDK, XP
DDK, and the IFS Kits for all those DDKs? You first need to know which of
those versions of the OS you must support. The XP IFS Kit provides several
new features to assist in writing file system filters, but they are not
backwards compatible. I would suggest you implement one driver for NT4/W2K
& another for XP, but you can use a single source tree and use conditional
compiling.

To see the correct behavior of MOST of the file system requests, build a
debug version of FastFat from the IFS Kit and set breakpoints on the various
entry points and see how each thing you do in ring 3 is translated to the
requests passed to the file system. There are a few items that differ with
NTFS, but not much. The primary reason that I won’t use NTFS on my systems
is that it must be a piece of junk or Microsoft would release the source in
the IFS Kit. I am of the opinion that those at Microsoft who know, won’t
let the source be released because they know the world will laugh at their
implementation of a Unix-like file system.

----- Original Message -----
From: “Nir Livni”
To: “File Systems Developers”
Sent: Sunday, September 22, 2002 10:20 AM
Subject: [ntfsd] RE: FileSystemFilterDriver - Filemon and notepad

> Is it a different kind of IRP ? What should I look for ?
>
> -----Original Message-----
> From: Tony Mason [mailto:xxxxx@osr.com]
> Sent: Sunday, September 22, 2002 5:08 PM
> To: File Systems Developers
> Subject: [ntfsd] RE: FileSystemFilterDriver - Filemon and notepad
>
>
> Notepad does not use read and write, it uses memory mapping. You are
> missing the read/write operations - they DO occur, but the manner in which
> they occur is a bit more complex (they may use a DIFFERENT file object for
> various implementation/technical reasons.)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: Nir Livni [mailto:xxxxx@cyber-ark.com]
> Sent: Sunday, September 22, 2002 8:48 AM
> To: File Systems Developers
> Subject: [ntfsd] FileSystemFilterDriver - Filemon and notepad
>
> Hi all.
> I’m a newbe here…
>
> Anyway,
> I’m currently trying to write a filesystem filter driver.
>
> In order to check it, I’ve tried some Win32 API file functions that seem
to
> work fine.
> But
> I’m having problems when trying to open a file with notepad.
> It simply does not run any IRP_MJ_READ requests.
> (Fast IO is disabled)
>
> When I tried to run filemon to check what IRP’s notepad issues,
> I couldn’t find any IRP_MJ_READ. (I disabled FastIO functions), but files
> where successfully opened with
> their content.
>
> Any explanation for that ?
>
> Thanks,
> Nir
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to %%email.unsub%%
>
> —
> You are currently subscribed to ntfsd as: xxxxx@cyber-ark.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to %%email.unsub%%
>