Filter ESP

NTFSD
1

Will I/O to the EFI system partition go through the standard file system device stack? Is it possible to filter on it?

2

EFI is FAT, so yes.
But not as early as you think if that is your question.

3

@Dejan_Maksimovic said:
EFI is FAT, so yes.
But not as early as you think if that is your question.

so the filter manager sits on both the fat32 file system device stack and the ntfs file system device stack? do we even have a device stack for each file system or simply one file system device stack?

4

What do you mean by “file system device stack”?

5

> @Dejan_Maksimovic said: > What do you mean by “file system device stack”? The device stack where IO initiated from functions like ReadFile and WriteFile is going to initially (there’s an article on OSR as well explaining the flow of ReadFile where it first reaches the file system device stack, then the volume , disk , storage etc (In that case ntfs.sys was on the “file system device stack” I’m referring to)

6

The stack is per volume. Not a common NTFS or FAT in general for all
volumes.

7

@Dejan_Maksimovic said:
The stack is per volume. Not a common NTFS or FAT in general for all
volumes.

makes sense, so when sending an I/O I believe its the responsability of the I/O manager to navigate it to the correct stack ? and each stack will have the fltmgr device object present - correct?

8

Exactly.