Thank you for your recommendations. I’m taking a close look at the options
you suggested.
I modified my code based on examples and Microsoft documentation that stated
the file needs to be open while I continued to work yesterday. At this
point, I have calls in place to:
InitializeObjectAttributes
FltCreateFileEx
ObReferenceObjectByHandle
FltQueryInformationFile or mySynchronousQueryInformationFile
ObDereferenceObject
FltClose
I wound up commenting out my code last night because when the execution
point reached FltQueryInformationFile or FltPerformSynchronousIo in
mySynchronousQueryInformationFile the system blue-screens.
I need to perform operations on the file before allowing the application to
access the file.
At this time I’m avoiding the PostCreate because I’m not sure I can prevent
access to the file from this event. Is this a correct assumption or can I
also reject file access during PostCreate.
Also, if I use PostCreate, can I perform operations on the file before the
calling program gets access to it? Is the PostCreate event synchronous in
the same way the PreCreate event is?
Thanks for your further recommendations.
David Webb
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, May 05, 2006 7:55 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Getting File Attributes in a MiniFilter PreCreate
routine
Can you do queries from post-create? In pre-create, the file is not
opened
yet.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “David Webb”
To: “Windows File Systems Devs Interest List”
Sent: Friday, May 05, 2006 7:32 AM
Subject: [ntfsd] Getting File Attributes in a MiniFilter PreCreate routine
> I’m working on a minifilter that needs to make a decision based on file
> attributes. I’ve played with FltQueryInformationFile as well as the
> mySynchronousQueryInformationFile sample at
> http://www.osronline.com/showThread.cfm?link=71952
>
>
>
> So far both of these options are giving me an error in the status value.
>
> mySynchronousQueryInformationFile gives me a STATUS_INVALID_PARAMETER
>
> FltQueryInformationFile also gives me a STATUS_INVALID_PARAMETER
>
>
>
> I’ve obviously passed a parameter incorrectly but I’m at a loss as to
which
> parameter is wrong. Any help would be greatly appreciated.
>
>
>
> FLT_PREOP_CALLBACK_STATUS FltPreCreate
>
> (IN OUT PFLT_CALLBACK_DATA
> pCallbackData,
>
> IN PCFLT_RELATED_OBJECTS FltObjects,
>
> OUT PVOID *CompletionContext
>
> )
>
> {
>
> FILE_BASIC_INFORMATION BasicInfo;
>
> ULONG LengthReturned;
>
> …
>
> // status = mySynchronousQueryInformationFile
>
> status = FltQueryInformationFile
>
> (FltObjects->Instance,
>
> FltObjects->FileObject,
>
> &BasicInfo,
>
> sizeof( FILE_BASIC_INFORMATION),
>
> FileBasicInformation,
>
> &LengthReturned
>
> );
>
> }
>
>
>
> Thanks and Best Regards,
>
>
>
> David Webb
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net
To unsubscribe send a blank email to xxxxx@lists.osr.com