FSF -> DirectIO to FS

NTFSD
1

Hello all,

Is it possible to send requests to the FS directly from a minifilter,
bypassing the other filters in between? The ‘Instance’ field is supposed to
help us, but how do i know the instance of the FS?

I understand we are not supposed to call Io manager functions directly,
hence the qn.

AP

PS: No, this is not a malware, or a product based on the false sense of
security, this is just out of curiosity.
And yes, i follow Alex’s blog, and have read all the articles :slight_smile:

2

You are perhaps not supposed to use IoXXX functions but you can. On the
other hand you can cause significant problems if some I/O goes through a
filter but not all, so think of the filters that could be below you. I
know you can send things directly since in the past it was the only way
to issue a number of requests from the mini-filter.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“A P” wrote in message news:xxxxx@ntfsd:

> Hello all,
>
> Is it possible to send requests to the FS directly from a minifilter,
> bypassing the other filters in between? The ‘Instance’ field is supposed to
> help us, but how do i know the instance of the FS?
>
> I understand we are not supposed to call Io manager functions directly,
> hence the qn.
>
> AP
>
> PS: No, this is not a malware, or a product based on the false sense of
> security, this is just out of curiosity.
> And yes, i follow Alex’s blog, and have read all the articles :slight_smile:

3

thank you don! No I dont intend ot use it, I was reading up alex’s blog and
got curious…

On Sun, Mar 6, 2011 at 4:12 AM, Don Burn wrote:

> You are perhaps not supposed to use IoXXX functions but you can. On the
> other hand you can cause significant problems if some I/O goes through a
> filter but not all, so think of the filters that could be below you. I know
> you can send things directly since in the past it was the only way to issue
> a number of requests from the mini-filter.
>
>
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
>
> “A P” wrote in message news:xxxxx@ntfsd:
>
>
> Hello all,
>>
>> Is it possible to send requests to the FS directly from a minifilter,
>> bypassing the other filters in between? The ‘Instance’ field is supposed
>> to
>> help us, but how do i know the instance of the FS?
>>
>> I understand we are not supposed to call Io manager functions directly,
>> hence the qn.
>>
>> AP
>>
>> PS: No, this is not a malware, or a product based on the false sense of
>> security, this is just out of curiosity.
>> And yes, i follow Alex’s blog, and have read all the articles :slight_smile:
>>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

There is no Instance associated with a file system. Also, you’re not really
supposed to use another filter’s instance, instances of your filter are
meant so that you can use them across volumes and such.

Also, bypassing filters is generally frowned upon. Whenever you do that you
make assumptions about what filters below yours do and you might be wrong.
The namespace might be completely different, data might be encrypted, and if
you use existing FILE_OBJECTs (as opposed to opening your own), they might
not have been opened by the FS (so you’d send an FO that the FS has never
seen). In fact, it might not even be the file system you think it is.

Thanks,

Alex.