Filter driver writes junk to network drive

NTFSD
1

I have a file system filter driver that works fine on local drives but is
writing junk (typically all 0xFF or 0x00) to a file on a remote drive.

Everything appears to be done properly:

  1. Allocating a buffer via ExAllocatePool(NonPagedPool, …)
  2. Allocating an Mdl for the buffer via IoAllocateMdl, and
    MmBuildMdlForNonPagedPool.
  3. Setting Irp->MdlAddress to the newly allocated Mdl address.
  4. Setting a completion routine and calling IoCallDriver.

As I mentioned, this works just fine on a local drive but ends up writing all
nulls or 0xFFs to a remote drive. The funny thing is that the allocated
buffer is always good (even in the completion routine), so it is not due to
the buffer being trashed. However, for some reason the redirector is picking
up the wrong address or an invalid address.

Any suggestions would be appreciated.

Thanks.

Neil

PS, LanmanRedirector is already hooked

2

Also try to set up the Irp->UserBuffer to your allocated buffer.

Paul

-----P?vodn? zpr?va-----
Od: Neil Weicher [SMTP:xxxxx@netlib.com]
Odesl?no: 11. ?ervence 2000 13:53
Komu: File Systems Developers
P?edm?t: [ntfsd] Filter driver writes junk to network drive

I have a file system filter driver that works fine on local drives but is
writing junk (typically all 0xFF or 0x00) to a file on a remote drive.

Everything appears to be done properly:

  1. Allocating a buffer via ExAllocatePool(NonPagedPool, …)
  2. Allocating an Mdl for the buffer via IoAllocateMdl, and
    MmBuildMdlForNonPagedPool.
  3. Setting Irp->MdlAddress to the newly allocated Mdl address.
  4. Setting a completion routine and calling IoCallDriver.

As I mentioned, this works just fine on a local drive but ends up writing
all
nulls or 0xFFs to a remote drive. The funny thing is that the allocated
buffer is always good (even in the completion routine), so it is not due
to
the buffer being trashed. However, for some reason the redirector is
picking
up the wrong address or an invalid address.

Any suggestions would be appreciated.

Thanks.

Neil

PS, LanmanRedirector is already hooked

You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Also try to set up the Irp->UserBuffer to your allocated buffer. >>

I was poking around in SoftIce yesterday and found that out. Thanks for the
confirmation.

Neil