FltCreateFileEx

NTFSD
1

Hello,

I need a little help with FltCreateFileEx. I want to use the Instance parameter to prevent creates from coming back through my filter, but it returns STATUS_INVALID_DEVICE_OBJECT_PARAMETER when I call it.

Here is the scenario:

In my Post DirectoryControl callback I call FltQueueDeferredIoWorkItem. The worker function calls Function A (passing FLT_CALLBACK_DATA parameter to worker function) then swaps the buffers.

In Function A I call Function B. Function B calls FltCreateFileEx to create a folder. When I call Function B I pass Data->Iopb->TargetInstance, which Function B then passes to FltCreateFileEx. So, I believe I am passing the FLT_CALLBACK_DATA from the Post DC Callback all the way through to FltCreateFileEx.

Any ideas why FltCreateFileEx returns STATUS_INVALID_DEVICE_OBJECT_PARAMETER?
Am I using the wrong instance pointer?

My filter is attached to the instance where I am creating the folder (verified by running fltmc).

This is how I call FltCreateFile:

status = FltCreateFileEx(g_FilterHandle,
Instance,
&hFolder,
NULL,
GENERIC_READ | GENERIC_WRITE,
&oa,
&Iosb,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE |
FILE_SHARE_DELETE,
FILE_CREATE,
FILE_DIRECTORY_FILE,
NULL,
0,
IO_IGNORE_SHARE_ACCESS_CHECK);

Thanks in advance for any help.

2

I should add too that I’d like to be able to call FltQueryInformationFile and FltSetInformationFile using this instance pointer also, but they fail as well.

3

I used FltGetVolumeInstanceFromName() to get the filter instance in my code which works fine.

4

Thanks kathir. This works for me as well.