FltQueryInformationFile failed in PreFileSystemControl

OSR_Community_User · September 4, 2010, 1:49am

HI,guys:
i want to monitor the fileid changes on FAT filesystem,the fileid can be
changed when disk defragmenting,
and i register a callback on IRP_MJ_FILE_SYSTEM_CONTROL to filter
FSCTL_MOV_FILE,but FltQueryInformationfile failed
with STATUS_INVALID_PARAMETER, the code is:

FltQueryInformationFile(pFltObjects->Instance,pFltObjects->FileObject,&fileInternalInfo,sizeof(fileInternalInfo),FileInternalInformation,&lenReturned);

i also use FltPerformSynchronousIo to perform myself i/o,but still
failed,the code is:

ntRes = FltAllocateCallbackData(Instance, FileObject, &Data);

if(!NT_SUCCESS(ntRes))
{
KdPrint((“FltAllocateCallbackData Failed!!!\n”));
return ntRes;
}

Data->Iopb->MajorFunction = IRP_MJ_QUERY_INFORMATION;

Data->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;

Data->Iopb->Parameters.QueryFileInformation.FileInformationClass =
FileInformationClass;

Data->Iopb->Parameters.QueryFileInformation.Length = Length;

Data->Iopb->Parameters.QueryFileInformation.InfoBuffer =
FileInformation;

FltPerformSynchronousIo(Data);

so anyone knows how can i get fileinformation in
PreFileSystemControl???Thanks alot!!!

rod_widdowson · September 4, 2010, 7:16am

Have you tried building a debug version of Fat and seeing where it goes wrong?
“Aimar” wrote in message news:xxxxx@ntfsd…
HI,guys:
i want to monitor the fileid changes on FAT filesystem,the fileid can be changed when disk defragmenting,
and i register a callback on IRP_MJ_FILE_SYSTEM_CONTROL to filter FSCTL_MOV_FILE,but FltQueryInformationfile failed
with STATUS_INVALID_PARAMETER, the code is:

FltQueryInformationFile(pFltObjects->Instance,pFltObjects->FileObject,&fileInternalInfo,sizeof(fileInternalInfo),FileInternalInformation,&lenReturned);

i also use FltPerformSynchronousIo to perform myself i/o,but still failed,the code is:

ntRes = FltAllocateCallbackData(Instance, FileObject, &Data);

if(!NT_SUCCESS(ntRes))
{
KdPrint((“FltAllocateCallbackData Failed!!!\n”));
return ntRes;
}

Data->Iopb->MajorFunction = IRP_MJ_QUERY_INFORMATION;

Data->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;

Data->Iopb->Parameters.QueryFileInformation.FileInformationClass = FileInformationClass;

Data->Iopb->Parameters.QueryFileInformation.Length = Length;

Data->Iopb->Parameters.QueryFileInformation.InfoBuffer = FileInformation;

FltPerformSynchronousIo(Data);

so anyone knows how can i get fileinformation in PreFileSystemControl???Thanks alot!!!

OSR_Community_User · September 4, 2010, 9:51am

On 9/3/2010 11:49 PM, Aimar wrote:

HI,guys:
i want to monitor the fileid changes on FAT filesystem,the fileid can be
changed when disk defragmenting,
and i register a callback on IRP_MJ_FILE_SYSTEM_CONTROL to filter
FSCTL_MOV_FILE,but FltQueryInformationfile failed
with STATUS_INVALID_PARAMETER, the code is:

FltQueryInformationFile(pFltObjects->Instance,pFltObjects->FileObject,&fileInternalInfo,sizeof(fileInternalInfo),FileInternalInformation,&lenReturned);

One thing to be aware, the object which the FSCTL_MOVE_FILE request is
issued against is an open instance of the entire volume. The handle to
which the FSCTL is to be applied is embedded within the MOVE_FILE_DATA.
Thus in your call above, pFltObjects->FileObject is a file object for
the entire volume and hence the request to retrieve the internal info on
it will fail. To determine the Internal Info for the file which the
FSCtl is being sent you need to extract it from the MOVE_FILE_DATA data
buffer.

Pete

i also use FltPerformSynchronousIo to perform myself i/o,but still
failed,the code is:

ntRes = FltAllocateCallbackData(Instance, FileObject, &Data);

if(!NT_SUCCESS(ntRes))
{
KdPrint((“FltAllocateCallbackData Failed!!!\n”));
return ntRes;
}

Data->Iopb->MajorFunction = IRP_MJ_QUERY_INFORMATION;

Data->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;

Data->Iopb->Parameters.QueryFileInformation.FileInformationClass =
FileInformationClass;

Data->Iopb->Parameters.QueryFileInformation.Length = Length;

Data->Iopb->Parameters.QueryFileInformation.InfoBuffer =
FileInformation;

FltPerformSynchronousIo(Data);

so anyone knows how can i get fileinformation in
PreFileSystemControl???Thanks alot!!!
— NTFSD is sponsored by OSR For our schedule of debugging and file
system seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server
section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

OSR_Community_User · September 4, 2010, 10:10am

Thank you scott,i have used the wrong fileobject

2010/9/4 Peter Scott

> On 9/3/2010 11:49 PM, Aimar wrote:
>
>> HI,guys:
>> i want to monitor the fileid changes on FAT filesystem,the fileid can be
>> changed when disk defragmenting,
>> and i register a callback on IRP_MJ_FILE_SYSTEM_CONTROL to filter
>> FSCTL_MOV_FILE,but FltQueryInformationfile failed
>> with STATUS_INVALID_PARAMETER, the code is:
>>
>>
>> FltQueryInformationFile(pFltObjects->Instance,pFltObjects->FileObject,&fileInternalInfo,sizeof(fileInternalInfo),FileInternalInformation,&lenReturned);
>>
>>
> One thing to be aware, the object which the FSCTL_MOVE_FILE request is
> issued against is an open instance of the entire volume. The handle to which
> the FSCTL is to be applied is embedded within the MOVE_FILE_DATA. Thus in
> your call above, pFltObjects->FileObject is a file object for the entire
> volume and hence the request to retrieve the internal info on it will fail.
> To determine the Internal Info for the file which the FSCtl is being sent
> you need to extract it from the MOVE_FILE_DATA data buffer.
>
> Pete
>
> i also use FltPerformSynchronousIo to perform myself i/o,but still
>> failed,the code is:
>>
>> ntRes = FltAllocateCallbackData(Instance, FileObject, &Data);
>>
>> if(!NT_SUCCESS(ntRes))
>> {
>> KdPrint((“FltAllocateCallbackData Failed!!!\n”));
>> return ntRes;
>> }
>>
>> Data->Iopb->MajorFunction = IRP_MJ_QUERY_INFORMATION;
>>
>> Data->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;
>>
>> Data->Iopb->Parameters.QueryFileInformation.FileInformationClass =
>> FileInformationClass;
>>
>> Data->Iopb->Parameters.QueryFileInformation.Length = Length;
>>
>> Data->Iopb->Parameters.QueryFileInformation.InfoBuffer =
>> FileInformation;
>>
>> FltPerformSynchronousIo(Data);
>>
>> so anyone knows how can i get fileinformation in
>> PreFileSystemControl???Thanks alot!!!
>> — NTFSD is sponsored by OSR For our schedule of debugging and file
>> system seminars (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars To unsubscribe, visit the List Server
>> section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>
> —
>
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>