is fileobject->fscontext unique for a filestream until the system restarts?
currently i keep track of fscontexts with a counter. for the first create request on a fscontext, a counter would be created. subsequent create requests would increment the counter. on close requests, the counter would be decremented and when it is zero, i stop tracking the fscontext and remove the counter.
i always thought that paging requests would happen after cleanup requests and before close requests, so whenever the counter is valid, i will handle the paging requests for the filestream. this seems to work for fat. however, excel and notepad behaves differently on ntfs as the paging writes would occur after close, even after i have removed the counter (ie all file objects should have closed).
so if the fscontext is unique throughout, i will not need to have a counter. instead i will just need to track all fscontexts that i am concerned with and store them in a list.
can i?
ampsi.
Use email, earn rewards at http://www.helloasia.com
i read from nagar’s book that the fscontext points to a
FSRTL_COMMON_FC_HEADER and there’s only one per file stream. is there a way
that i can track whether the FSRTL_COMMON_FC_HEADER a particular fscontext
points to is valid? i hope to track the valid FSRTL_COMMON_FC_HEADERs so
that i will only handle the file streams that are valid.
Ho Mun Chuen
xxxxx@pmail.ntu.edu.sg
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
If I understand correctly your question you want to check
filtered FSD’s FSRTL_COMMON_FCB_HEADER structure
for validity. Is it right ?
I think some generic way to do this will be a little bit complicated.
You can try to use checks like these:
->IsFastIoPossible should be <= FastIoIsQuestionable
->Reserved should be zero
->Resource should be non-zero and system space address
->ValidDataLength should be <= FileSize
Paul
-----P?vodn? zpr?va-----
Od: Ho Mun Chuen [SMTP:xxxxx@pmail.ntu.edu.sg]
Odesl?no: 4. ?ervence 2000 11:59
Komu: File Systems Developers
P?edm?t: [ntfsd] fscontext
i read from nagar’s book that the fscontext points to a
FSRTL_COMMON_FC_HEADER and there’s only one per file stream. is there a
way
that i can track whether the FSRTL_COMMON_FC_HEADER a particular fscontext
points to is valid? i hope to track the valid FSRTL_COMMON_FC_HEADERs so
that i will only handle the file streams that are valid.
Ho Mun Chuen
xxxxx@pmail.ntu.edu.sg
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
To unsubscribe send a blank email to $subst(‘Email.Unsub’)