FltCreateFile with FILE_CREATE always gets ACCESS_VIOLATION

NTFSD
1

I have tried to use FltCreateFile() in a minifilter driver. It’s strange that if FILE_CREATE is set, FltCreateFile always get STATUS_ACCESS_VIOLATION (0xC0000005L). But the file is actually created, FILE_CREATED is found also if I use minifilter to watch the volume.

Another test with FILE_OPEN to open a exist file. It’s ok to do opening file.

Does any one find the same problem?

The following is my implementation:

RtlInitUnicodeString( &uniString, L"\??\c:\CreateFIle.log");

InitializeObjectAttributes( &oa, &uniString, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL)

Status = FltCreateFile( MFFSData.Filter, Data->Iopb->TargetInstance, handle, FILE_GENERIC_WRITE, &oa, &ioStatus, (PLARGE_INTEGER) NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_CREATE, FILE_NON_DIRECTORY_FILE, NULL, 0, IO_IGNORE_SHARE_ACCESS_CHECK);

if (NT_SUCCESS( Status )) Status = FltClose(*handle);

2

How is handle declared?

On Jan 23, 2008 10:23 PM, wrote:

>
> I have tried to use FltCreateFile() in a minifilter driver. It’s strange
> that if FILE_CREATE is set, FltCreateFile always get STATUS_ACCESS_VIOLATION
> (0xC0000005L). But the file is actually created, FILE_CREATED is found also
> if I use minifilter to watch the volume.
>
> Another test with FILE_OPEN to open a exist file. It’s ok to do opening
> file.
>
> Does any one find the same problem?
>
> The following is my implementation:
>
> RtlInitUnicodeString( &uniString, L"\??\c:\CreateFIle.log");
>
> InitializeObjectAttributes( &oa, &uniString, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL, NULL)
>
> Status = FltCreateFile( MFFSData.Filter, Data->Iopb->TargetInstance,
> handle, FILE_GENERIC_WRITE, &oa, &ioStatus, (PLARGE_INTEGER) NULL,
> FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE |
> FILE_SHARE_DELETE, FILE_CREATE, FILE_NON_DIRECTORY_FILE, NULL, 0,
> IO_IGNORE_SHARE_ACCESS_CHECK);
>
> if (NT_SUCCESS( Status )) Status = FltClose(*handle);
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Mark Roddy

3

hmmm… I thought the handle should can’t be access when getting STATUS_ACCESS_VIOLATION.