FltIsDirectory fails with STATUS_INVALID_PARAMETER

NTFSD
1

Hi.

I’m writing a FS mini filter.

In my post create callback, upon successful opening (that is Data->IoStatus.Status == NT_SUCCESS), I try to determine if a directory file was opened.
I try to do so by calling FltIsDirectory() .

Most of the time, the function works fine, but once in a while (haven’t determined yet when exactly) if fails with STATUS_INVALID_PARAMETER.

Any Ideas?

Thanks,
Ariel

2

Before calling FltIsDirectory check status of IoStatus
like

if( Data->IoStatus.Information == 0 || Data->IoStatus.Information > 0x5 )
return;
FltIsDirectory(FltObjects->FileObject, FltObjects->Instance, &bIsDirectory );

I have seen if Information is not in this range then FltIsDirectory fails…

Eris

3

Hey Eris.

Is there any reason for that behavior? how did you decide on Information > 0x5?

Ariel

4

To do a test on this value without knowing its meaning is not a good idea.

For a create operation, IoStatus.Information will be set to one of the
following values:

FILE_CREATED
FILE_DOES_NOT_EXIST
FILE_EXISTS
FILE_OPENED
FILE_OVERWRITTEN
FILE_SUPERSEDED

//Daniel

wrote in message news:xxxxx@ntfsd…
> Before calling FltIsDirectory check status of IoStatus
> like
>
> if( Data->IoStatus.Information == 0 || Data->IoStatus.Information > 0x5 )
> return;
> FltIsDirectory(FltObjects->FileObject, FltObjects->Instance,
> &bIsDirectory );
>
> I have seen if Information is not in this range then FltIsDirectory
> fails…
>
>
>
> Eris
>

5

OK. but 5 is supposed to be the maximum value of information, isn’t it?

another thing, FILE_DOES_NOT_EXIST is a failure code, no?

ariel

6

The query for FILE_STANDARD_INFORMATION is probably failing with
STATUS_INVALID_PARAMETER.

Can you assert when this occurs and dump the file object - “!fileobj
”?

Also what platform are you running on? What is the file system below
your filter?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

xxxxx@hotmail.com wrote:
> Hi.
>
> I’m writing a FS mini filter.
>
> In my post create callback, upon successful opening (that is Data->IoStatus.Status == NT_SUCCESS), I try to determine if a directory file was opened.
> I try to do so by calling FltIsDirectory() .
>
> Most of the time, the function works fine, but once in a while (haven’t determined yet when exactly) if fails with STATUS_INVALID_PARAMETER.
>
> Any Ideas?
>
> Thanks,
> Ariel
>
>

7

I’m working on NTFS, XP and will get you a file object dump as soon as It’ll happen again.

Ariel.