Filter driver

NTFSD
1

Hi!
I write file system filter driver. But I have one problem. In my dispatch
procedure for IRP with major code IRP_MJ_CREATE I pass this request to next
driver in stack by IoCall Driver. After file system driver complete request
I need read some data from this file. I allocate IRP with major code
IRP_MJ_READ (I use IoAllocateIrp) and send this IRP to file system driver.
Data read succesfully but OS work not correct with files (example exe files
won’t run) when running my filter.
If build IRP with IoBuildSynchronousRequest then OS crash.

Best regards,
Victor

2

> After file system driver complete request

I need read some data from this file.
You may want to re-read IFS FAQs at
http://www.osronline.com/article.cfm?article=17,
specifically Q34 (“Opening files during
IRP_MJ_CREATE processing”).

----- Original Message -----
From: “Fisyuk Victor”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Monday, February 20, 2006 10:13 AM
Subject: [ntfsd] Filter driver

> Hi!
> I write file system filter driver. But I have one problem. In my dispatch
> procedure for IRP with major code IRP_MJ_CREATE I pass this request to
> next
> driver in stack by IoCall Driver. After file system driver complete
> request
> I need read some data from this file. I allocate IRP with major code
> IRP_MJ_READ (I use IoAllocateIrp) and send this IRP to file system driver.
> Data read succesfully but OS work not correct with files (example exe
> files
> won’t run) when running my filter.
> If build IRP with IoBuildSynchronousRequest then OS crash.
>
> Best regards,
> Victor
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@bellsouth.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

I have found the solving of this problem. Before call IoCallDriver to send
IRP_MJ_READ for reading from file we must save FileObject->CurrentByteOffset
value and restore this value after completing request.