Dear,
I’m trying to do a filter driver which hooks IRP_MJ_READ/WRITE
and decrypts/encrypts the data in the disk. The problem is I can’t change
the information of directory, and only deal with the
file data. How can I know whether a file object which I have hooked is a
file data?
Thanks!
The only way I know of is to query the filesystem. Of
course you won’t want to do this on every read/write
request.
— Zhang Chong wrote:
> Dear,
> I’m trying to do a filter driver which hooks
> IRP_MJ_READ/WRITE
> and decrypts/encrypts the data in the disk. The
> problem is I can’t change
> the information of directory, and only deal with the
> file data. How can I know whether a file object
> which I have hooked is a
> file data?
> Thanks!
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail
You can also hook the IRP_MJ_CREATE too.
(You will have to do this sooner or later, when writing
an encryption filter).
At create, you can test the options.
- If they contain FILE_DIRECTORY_FILE, the file
is actually a directory after create succeeds. - If they contain FILE_NON_DIRECTORY_FILE,
the opened file is really a file after successful create - If they don’t contain any of the flags above, you have to query
the file object for FILE_STANDARD_INFORMATION
(as Randy Cook has adviced you).
L.
thanks,
when I get the full file name, I’ve queried the filesystem:)
Now, I don’t know which parameter can tell me that its an actual file data,
because there are lots of parameters:(
or does the fileobject in the IRP have something to tell me ?
“Randy Cook” ??? news:xxxxx@ntfsd…
> The only way I know of is to query the filesystem. Of
> course you won’t want to do this on every read/write
> request.
>
> — Zhang Chong wrote:
> > Dear,
> > I’m trying to do a filter driver which hooks
> > IRP_MJ_READ/WRITE
> > and decrypts/encrypts the data in the disk. The
> > problem is I can’t change
> > the information of directory, and only deal with the
> > file data. How can I know whether a file object
> > which I have hooked is a
> > file data?
> > Thanks!
> >
> >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
>
>
>
>
> __________________________________
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
> http://promotions.yahoo.com/new_mail
>
You can dend an IRP_MJ_QUERY_INFORMATION Irp for information class
FileStandardInformation - have a look at FILE_STANDARD_INFORMATION datatype
definition its a bit obvious 
Good luck
Lyndon
“Zhang Chong” wrote in message news:xxxxx@ntfsd…
> thanks,
> when I get the full file name, I’ve queried the filesystem:)
> Now, I don’t know which parameter can tell me that its an actual file
data,
> because there are lots of parameters:(
>
> or does the fileobject in the IRP have something to tell me ?
>
>
> “Randy Cook” ??? news:xxxxx@ntfsd…
> > The only way I know of is to query the filesystem. Of
> > course you won’t want to do this on every read/write
> > request.
> >
> > — Zhang Chong wrote:
> > > Dear,
> > > I’m trying to do a filter driver which hooks
> > > IRP_MJ_READ/WRITE
> > > and decrypts/encrypts the data in the disk. The
> > > problem is I can’t change
> > > the information of directory, and only deal with the
> > > file data. How can I know whether a file object
> > > which I have hooked is a
> > > file data?
> > > Thanks!
> > >
> > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as:
> > > xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > > xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > New and Improved Yahoo! Mail - 100MB free storage!
> > http://promotions.yahoo.com/new_mail
> >
>
>
>
If you do this, you must also check the disposition in
post-create to see if an existing file/directory was
opened (rather than created). If an existing object
was opened, then you don’t know if it was a file or
directory and must query.
— Ladislav Zezula wrote:
> You can also hook the IRP_MJ_CREATE too.
> (You will have to do this sooner or later, when
> writing
> an encryption filter).
>
> At create, you can test the options.
> - If they contain FILE_DIRECTORY_FILE, the file
> is actually a directory after create succeeds.
> - If they contain FILE_NON_DIRECTORY_FILE,
> the opened file is really a file after successful
> create
> - If they don’t contain any of the flags above, you
> have to query
> the file object for FILE_STANDARD_INFORMATION
> (as Randy Cook has adviced you).
>
> L.
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
I find, at least on w2k, if FILE_DIRECTORY_FILE is supplied for open of a
thing which happens not to be a directory, the irp fails with
STATUS_NOT_A_DIRECTORY, and if FILE_NON_DIRECTORY_FILE is supplied for open
of a thing hwich happens to be a directory, the irp fails with
STATUS_FILE_IS_A_DIRECTORY. So I think that if either of these options are
supplied and the irp succeeds I can infer whether the thing was or was not a
directory, so long as the thing was not a volume (in which case the open
seems to succeed irrespective of these options); trouble is almost all of
the time these options are not supplied.
Question: Can a directory be “overwritten” as in the IoStatus.Information
from the IRP_MJ_CREATE contains FILE_OVERWRITTEN when the thing was a
directory? What about FILE_SUPERSEDED?
“Randy Cook” wrote in message news:xxxxx@ntfsd…
> If you do this, you must also check the disposition in
> post-create to see if an existing file/directory was
> opened (rather than created). If an existing object
> was opened, then you don’t know if it was a file or
> directory and must query.
>
> — Ladislav Zezula wrote:
> > You can also hook the IRP_MJ_CREATE too.
> > (You will have to do this sooner or later, when
> > writing
> > an encryption filter).
> >
> > At create, you can test the options.
> > - If they contain FILE_DIRECTORY_FILE, the file
> > is actually a directory after create succeeds.
> > - If they contain FILE_NON_DIRECTORY_FILE,
> > the opened file is really a file after successful
> > create
> > - If they don’t contain any of the flags above, you
> > have to query
> > the file object for FILE_STANDARD_INFORMATION
> > (as Randy Cook has adviced you).
> >
> > L.
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>
Hook noncached IO only.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Zhang Chong”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Thursday, July 01, 2004 5:46 PM
Subject: [ntfsd] Help! How can I know whether a file object is a directory?
> Dear,
> I’m trying to do a filter driver which hooks IRP_MJ_READ/WRITE
> and decrypts/encrypts the data in the disk. The problem is I can’t change
> the information of directory, and only deal with the
> file data. How can I know whether a file object which I have hooked is a
> file data?
> Thanks!
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com