Get mini-filter instance for sysroot volume?

NTFSD
1

I need to create and write a file in “\sysroot\myfolder”. I know I could
just use this path for ZwCreateFile, but I want to use FltCreateFile instead
to avoid re-entrancy and it requires a reference to the instance of my
mini-filter above the sysroot volume. I searched and searched and the
easiest way I could find to locate this instance is via the code below.
This code seems REALLY complicated for something that should be simple. Is
there some easier way to do this that I overlooked? (This is untested code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL );
ZwCreateFile( &sysRootHandle, FILE_TRAVERSE, &attr, &ioStatus, NULL, 0,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL,
0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL );
ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen );
FltGetVolumeFromName( gFilter, &sysVolName, &pVol );
FltGetVolumeInstanceFromName( gFilter, pVol, NULL, &gBootVolInstance );

All of this long code just converts L"\SystemRoot" into gBootVolInstance.
I’ve removed error-checking and object-releasing code for ease-of-reading.
You should see how long the real code is!

2

Mark:

The only alternative that comes to mind is to detect it during instance
setup.

If you get and save the device name (\Device\HarddiskVolume1) during driver
entry, your driver isn’t started yet so reentrancy isn’t an issue. Then
test the string (using FltGetVolumeName()) during instance setup, and if it
matches you should have your instance.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 4:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Get mini-filter instance for sysroot volume?

I need to create and write a file in “\sysroot\myfolder”. I know I could
just use this path for ZwCreateFile, but I want to use FltCreateFile instead

to avoid re-entrancy and it requires a reference to the instance of my
mini-filter above the sysroot volume. I searched and searched and the
easiest way I could find to locate this instance is via the code below.
This code seems REALLY complicated for something that should be simple. Is
there some easier way to do this that I overlooked? (This is untested code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL );
ZwCreateFile( &sysRootHandle, FILE_TRAVERSE, &attr, &ioStatus, NULL, 0,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL,
0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL );
ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen );
FltGetVolumeFromName( gFilter, &sysVolName, &pVol );
FltGetVolumeInstanceFromName( gFilter, pVol, NULL, &gBootVolInstance );

All of this long code just converts L"\SystemRoot" into gBootVolInstance.
I’ve removed error-checking and object-releasing code for ease-of-reading.
You should see how long the real code is!

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

I thought of that. The only problem is that I have no idea which volume is
the boot volume that contains sysroot.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Mark:
>
> The only alternative that comes to mind is to detect it during instance
> setup.
>
> If you get and save the device name (\Device\HarddiskVolume1) during
> driver
> entry, your driver isn’t started yet so reentrancy isn’t an issue. Then
> test the string (using FltGetVolumeName()) during instance setup, and if
> it
> matches you should have your instance.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Monday, March 21, 2005 4:28 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Get mini-filter instance for sysroot volume?
>
> I need to create and write a file in “\sysroot\myfolder”. I know I could
> just use this path for ZwCreateFile, but I want to use FltCreateFile
> instead
>
> to avoid re-entrancy and it requires a reference to the instance of my
> mini-filter above the sysroot volume. I searched and searched and the
> easiest way I could find to locate this instance is via the code below.
> This code seems REALLY complicated for something that should be simple.
> Is
> there some easier way to do this that I overlooked? (This is untested
> code):
>
> RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
> InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL, NULL );
> ZwCreateFile( &sysRootHandle, FILE_TRAVERSE, &attr, &ioStatus, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0,
> NULL,
> 0 );
> ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
> NULL );
> ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
> sizeof(sysVolName), &retlen );
> FltGetVolumeFromName( gFilter, &sysVolName, &pVol );
> FltGetVolumeInstanceFromName( gFilter, pVol, NULL, &gBootVolInstance );
>
> All of this long code just converts L"\SystemRoot" into gBootVolInstance.
> I’ve removed error-checking and object-releasing code for ease-of-reading.
> You should see how long the real code is!
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

Right, which is why you need to get the device name during DriverEntry. You
do it then to avoid re-entrancy issues.

Call ZwCreateFile like you have shown at the bottom and save the results,
which you can check during InstanceSetup.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 2:56 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Get mini-filter instance for sysroot volume?

I thought of that. The only problem is that I have no idea which volume is
the boot volume that contains sysroot.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Mark:
>
> The only alternative that comes to mind is to detect it during instance
> setup.
>
> If you get and save the device name (\Device\HarddiskVolume1) during
> driver
> entry, your driver isn’t started yet so reentrancy isn’t an issue. Then
> test the string (using FltGetVolumeName()) during instance setup, and if
> it
> matches you should have your instance.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Monday, March 21, 2005 4:28 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Get mini-filter instance for sysroot volume?
>
> I need to create and write a file in “\sysroot\myfolder”. I know I could
> just use this path for ZwCreateFile, but I want to use FltCreateFile
> instead
>
> to avoid re-entrancy and it requires a reference to the instance of my
> mini-filter above the sysroot volume. I searched and searched and the
> easiest way I could find to locate this instance is via the code below.
> This code seems REALLY complicated for something that should be simple.
> Is
> there some easier way to do this that I overlooked? (This is untested
> code):
>
> RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
> InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL, NULL );
> ZwCreateFile( &sysRootHandle, FILE_TRAVERSE, &attr, &ioStatus, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0,
> NULL,
> 0 );
> ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
> NULL );
> ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
> sizeof(sysVolName), &retlen );
> FltGetVolumeFromName( gFilter, &sysVolName, &pVol );
> FltGetVolumeInstanceFromName( gFilter, pVol, NULL, &gBootVolInstance );
>
> All of this long code just converts L"\SystemRoot" into gBootVolInstance.
> I’ve removed error-checking and object-releasing code for ease-of-reading.
> You should see how long the real code is!
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Mark:

Another option is to store the device name somewhere in the registry where
your driver can read it.

For example, you could write a simple utility that calls QueryDosDevice() on
the system disk during installation and stores the resulting string in the
registry.

Then, during InstanceSetup, compare the current volume to the one saved in
the registry.

It’s not perfect because there may be a remote possibility that the device
name could change after installation (like from \Device\HarddiskVolume1 to
\Device\HarddiskVolume2), but changing this on the system disk is
exceedingly rare (is it even possible?).

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 2:56 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Get mini-filter instance for sysroot volume?

I thought of that. The only problem is that I have no idea which volume is
the boot volume that contains sysroot.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Mark:
>
> The only alternative that comes to mind is to detect it during instance
> setup.
>
> If you get and save the device name (\Device\HarddiskVolume1) during
> driver
> entry, your driver isn’t started yet so reentrancy isn’t an issue. Then
> test the string (using FltGetVolumeName()) during instance setup, and if
> it
> matches you should have your instance.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Monday, March 21, 2005 4:28 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Get mini-filter instance for sysroot volume?
>
> I need to create and write a file in “\sysroot\myfolder”. I know I could
> just use this path for ZwCreateFile, but I want to use FltCreateFile
> instead
>
> to avoid re-entrancy and it requires a reference to the instance of my
> mini-filter above the sysroot volume. I searched and searched and the
> easiest way I could find to locate this instance is via the code below.
> This code seems REALLY complicated for something that should be simple.
> Is
> there some easier way to do this that I overlooked? (This is untested
> code):
>
> RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
> InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL, NULL );
> ZwCreateFile( &sysRootHandle, FILE_TRAVERSE, &attr, &ioStatus, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0,
> NULL,
> 0 );
> ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
> NULL );
> ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
> sizeof(sysVolName), &retlen );
> FltGetVolumeFromName( gFilter, &sysVolName, &pVol );
> FltGetVolumeInstanceFromName( gFilter, pVol, NULL, &gBootVolInstance );
>
> All of this long code just converts L"\SystemRoot" into gBootVolInstance.
> I’ve removed error-checking and object-releasing code for ease-of-reading.
> You should see how long the real code is!
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

This is close to what you need to do. Here’s what I did in the System
Restore filter when I ported it to a minifilter:

  1. Use ZwCreateFile to open \SystemRoot

  2. Use ObReferenceObjectbyHandle to convert the handle to a file object.

  3. Use FltGetVolumeFromFileObject to get the volume that \SystemRoot
    resides on.

  4. Use FltEnumerateInstances to find your instance that is attached to
    the system root volume.

I then cached this instance globally in the filter since it won’t change
while the OS is loaded.

I believe that adding a helper function to the Filter Manager to make
this easier for filters is on Neal’s list of “nice things to have” for a
future Filter Manager release.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 1:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Get mini-filter instance for sysroot volume?

I need to create and write a file in “\sysroot\myfolder”. I know I
could just use this path for ZwCreateFile, but I want to use
FltCreateFile instead to avoid re-entrancy and it requires a reference
to the instance of my mini-filter above the sysroot volume. I searched
and searched and the easiest way I could find to locate this instance is
via the code below.
This code seems REALLY complicated for something that should be simple.
Is there some easier way to do this that I overlooked? (This is untested
code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL ); ZwCreateFile( &sysRootHandle,
FILE_TRAVERSE, &attr, &ioStatus, NULL, 0, FILE_SHARE_READ |
FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL, 0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL ); ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen ); FltGetVolumeFromName( gFilter,
&sysVolName, &pVol ); FltGetVolumeInstanceFromName( gFilter, pVol, NULL,
&gBootVolInstance );

All of this long code just converts L"\SystemRoot" into
gBootVolInstance.
I’ve removed error-checking and object-releasing code for
ease-of-reading.
You should see how long the real code is!

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Thanks. My code is very similar to yours except that I use a
FltGetVolumeInstanceFromName call instead of going to the trouble to
enumerate my instances. This works fine. It is a lot of code though for
something that seems simple.

Is there any advantage to enumerating instances like you do instead of just
letting the filter manager scan the stack in FltGetVolumeInstanceFromName?

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
This is close to what you need to do. Here’s what I did in the System
Restore filter when I ported it to a minifilter:

1. Use ZwCreateFile to open \SystemRoot
2. Use ObReferenceObjectbyHandle to convert the handle to a file object.

3. Use FltGetVolumeFromFileObject to get the volume that \SystemRoot
resides on.
4. Use FltEnumerateInstances to find your instance that is attached to
the system root volume.

I then cached this instance globally in the filter since it won’t change
while the OS is loaded.

I believe that adding a helper function to the Filter Manager to make
this easier for filters is on Neal’s list of “nice things to have” for a
future Filter Manager release.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 1:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Get mini-filter instance for sysroot volume?

I need to create and write a file in “\sysroot\myfolder”. I know I
could just use this path for ZwCreateFile, but I want to use
FltCreateFile instead to avoid re-entrancy and it requires a reference
to the instance of my mini-filter above the sysroot volume. I searched
and searched and the easiest way I could find to locate this instance is
via the code below.
This code seems REALLY complicated for something that should be simple.
Is there some easier way to do this that I overlooked? (This is untested
code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL ); ZwCreateFile( &sysRootHandle,
FILE_TRAVERSE, &attr, &ioStatus, NULL, 0, FILE_SHARE_READ |
FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL, 0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL ); ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen ); FltGetVolumeFromName( gFilter,
&sysVolName, &pVol ); FltGetVolumeInstanceFromName( gFilter, pVol, NULL,
&gBootVolInstance );

All of this long code just converts L"\SystemRoot" into
gBootVolInstance.
I’ve removed error-checking and object-releasing code for
ease-of-reading.
You should see how long the real code is!

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

I should have been clearer in my response – yes, what you were doing
would work, but enumerating the instances is faster. To translate the
name to a volume, the Filter Manager needs to opened the device and
opens are expensive. Once the Filter Manager has a handle to the
volume, it will do the instance enumeration to find the correct instance
to return.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Tuesday, March 22, 2005 1:26 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Get mini-filter instance for sysroot volume?

Thanks. My code is very similar to yours except that I use a
FltGetVolumeInstanceFromName call instead of going to the trouble to
enumerate my instances. This works fine. It is a lot of code though
for something that seems simple.

Is there any advantage to enumerating instances like you do instead of
just letting the filter manager scan the stack in
FltGetVolumeInstanceFromName?

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
This is close to what you need to do. Here’s what I did in the System
Restore filter when I ported it to a minifilter:

1. Use ZwCreateFile to open \SystemRoot 2. Use
ObReferenceObjectbyHandle to convert the handle to a file object.

3. Use FltGetVolumeFromFileObject to get the volume that \SystemRoot
resides on.
4. Use FltEnumerateInstances to find your instance that is attached to
the system root volume.

I then cached this instance globally in the filter since it won’t change
while the OS is loaded.

I believe that adding a helper function to the Filter Manager to make
this easier for filters is on Neal’s list of “nice things to have” for a
future Filter Manager release.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 1:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Get mini-filter instance for sysroot volume?

I need to create and write a file in “\sysroot\myfolder”. I know I
could just use this path for ZwCreateFile, but I want to use
FltCreateFile instead to avoid re-entrancy and it requires a reference
to the instance of my mini-filter above the sysroot volume. I searched
and searched and the easiest way I could find to locate this instance is
via the code below.
This code seems REALLY complicated for something that should be simple.
Is there some easier way to do this that I overlooked? (This is untested
code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL ); ZwCreateFile( &sysRootHandle,
FILE_TRAVERSE, &attr, &ioStatus, NULL, 0, FILE_SHARE_READ |
FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL, 0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL ); ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen ); FltGetVolumeFromName( gFilter,
&sysVolName, &pVol ); FltGetVolumeInstanceFromName( gFilter, pVol, NULL,
&gBootVolInstance );

All of this long code just converts L"\SystemRoot" into
gBootVolInstance.
I’ve removed error-checking and object-releasing code for
ease-of-reading.
You should see how long the real code is!

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

I have filed an enhancement request to add a new filter manager API to
implement this functionality.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Molly Brown
Sent: Tuesday, March 22, 2005 2:09 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Get mini-filter instance for sysroot volume?

I should have been clearer in my response – yes, what you were doing
would work, but enumerating the instances is faster. To translate the
name to a volume, the Filter Manager needs to opened the device and
opens are expensive. Once the Filter Manager has a handle to the
volume, it will do the instance enumeration to find the correct instance
to return.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Tuesday, March 22, 2005 1:26 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Get mini-filter instance for sysroot volume?

Thanks. My code is very similar to yours except that I use a
FltGetVolumeInstanceFromName call instead of going to the trouble to
enumerate my instances. This works fine. It is a lot of code though
for something that seems simple.

Is there any advantage to enumerating instances like you do instead of
just letting the filter manager scan the stack in
FltGetVolumeInstanceFromName?

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
This is close to what you need to do. Here’s what I did in the System
Restore filter when I ported it to a minifilter:

1. Use ZwCreateFile to open \SystemRoot 2. Use
ObReferenceObjectbyHandle to convert the handle to a file object.

3. Use FltGetVolumeFromFileObject to get the volume that \SystemRoot
resides on.
4. Use FltEnumerateInstances to find your instance that is attached to
the system root volume.

I then cached this instance globally in the filter since it won’t change
while the OS is loaded.

I believe that adding a helper function to the Filter Manager to make
this easier for filters is on Neal’s list of “nice things to have” for a
future Filter Manager release.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Monday, March 21, 2005 1:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Get mini-filter instance for sysroot volume?

I need to create and write a file in “\sysroot\myfolder”. I know I
could just use this path for ZwCreateFile, but I want to use
FltCreateFile instead to avoid re-entrancy and it requires a reference
to the instance of my mini-filter above the sysroot volume. I searched
and searched and the easiest way I could find to locate this instance is
via the code below.
This code seems REALLY complicated for something that should be simple.
Is there some easier way to do this that I overlooked? (This is untested
code):

RtlInitUnicodeString( &rootPath, L"\SystemRoot" );
InitializeObjectAttributes( &attr, &rootPath, OBJ_CASE_INSENSITIVE |
OBJ_KERNEL_HANDLE, NULL, NULL ); ZwCreateFile( &sysRootHandle,
FILE_TRAVERSE, &attr, &ioStatus, NULL, 0, FILE_SHARE_READ |
FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL, 0 );
ObReferenceObjectByHandle( sysRootHandle, 0, NULL, KernelMode, &fileObj,
NULL ); ObQueryNameString( fileObj->Vpb->DeviceObject, &sysVolName,
sizeof(sysVolName), &retlen ); FltGetVolumeFromName( gFilter,
&sysVolName, &pVol ); FltGetVolumeInstanceFromName( gFilter, pVol, NULL,
&gBootVolInstance );

All of this long code just converts L"\SystemRoot" into
gBootVolInstance.
I’ve removed error-checking and object-releasing code for
ease-of-reading.
You should see how long the real code is!

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com