Hi!
I know this topic has been discussed before, but I saw where at least one programmer had an intermittent issue which was never resolved. I am working with a mini-filter driver and calling FltIsDirectory in my post-create callback. However, I have noted a particular scenario under which this fails for me. I am using Windows XP SP 3.
The scenario involves a user simply renaming (not creating) a folder (not a file) in an explorer window. When this happens, several create IRPs for the directory containing the folder occur and one of them fails in the FltIsDirectory call with STATUS_INVALID_PARAMETER. Further, FltQueryInformationFile also fails with STATUS_INVALID_PARAMETER.
Can anyone else confirm this and/or suggest a work-around?
Stephen Fox
Was the create in question successful ? Is the FILE_OBJECT->FsContext null ?
Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.
Alex,
IoStatus.Status is set to STATUS_SUCCESS and PFILE_OBJECT->FsContext is not null.
Also, I forgot to mention that I am also catching the subsequent CLEANUP IRP in a pre-op callback and FltIsDirectory also fails there.
Stephen
Hmm, there goes the easy case. This is a pretty complicated function and I don’t have enough information to go on. Please try running with verifier enabled and a checked filter manager, these might show if something is wrong at filter manager level. Did you check if IO was issued as a result of your call ? You should see an IRP_MJ_QUERY_INFORMATION with FILE_STANDARD_INFORMATION. If that IO fails the same way then it’s the file system, so a checked FS might show more.
Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.
Alex,
I did turn on verifier and targeted my minifilter. After the reboot, nothing happened, so I assume nothing is wrong with the minifilter. It was unclear whether or not you wanted me to target Filter Manager as well. I don’t want to run a checked filter manager because I don’t have a dedicated test machine at this time. Also, because I am not remote debugging, I don’t think I can answer the question about whether or not I/O was actually issued. (If this is not correct, please let me know.) All information I have provided on this issue was obtained either via FileSpy or directly reported out of my driver. If you still feel that there is not enough information to proceed, then please accept my apology, and I will hold off further refinement of my minifilter until I get a dedicated test machine.
Currently, I am only attaching to lanmanredirector and looking at Create, Write, Set Information (for file renames), and Cleanup IRPs. I am currently only reporting those IRPs where I can’t determine whether or not the file is a directory and a single Create/Cleanup pair is always reported when I do the rename via the Explorer window (whether or not the target is a file or directory), even though the same file is opened many times. When I do the rename operation via the console, I can always resolve whether or not the target is a directory.
Stephen