FsRtlRegisterFileSystemFilterCallbacks exported on W2K

NTFSD
1

FYI.

With the W2K KB890859 update a couple of days ago, I found that “x
nt!FsRtl*” is now exporting FsRtlRegisterFileSystemFilterCallbacks function.

I hope that we can now use it in our FSFDs for W2Ks and finally get rid of
hooking to W2K FastIoDispatch equivalents.

Also some other functions (IoAttachDeviceToDeviceStackSafe,
IoEnumerateDeviceObjectList, IoGetLowerDeviceObject,
IoGetDeviceAttachmentBaseRef, IoGetDiskDeviceObject) that were available
only on WXP and later are exported with this kernel patch on W2K too.

WBR Primoz

2

Primoz Beltram wrote:

With the W2K KB890859 update a couple of days ago, I found that “x
nt!FsRtl*” is now exporting FsRtlRegisterFileSystemFilterCallbacks
function.

I hope that we can now use it in our FSFDs for W2Ks and finally get rid of
hooking to W2K FastIoDispatch equivalents.

It seems to work just fine, though it was a bit of a surprise when our unit
tests suddenly started kicking out errors because their expectations were
set by operating system version. :slight_smile: