HELP - Unable to trap FILE_OPEN

NTDEV
1

I am developing a filter driver for a NT file system, and want to trap FILE OPEN and DIRECTORY OPEN requests.

 

At present I am trapping IRP_MJ_CREATE for open request.

and using the following lines of source

 

DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >> 24) & 0xFF);

DWORD dwUserOptions = (pParms->Parameters.Create.Options & FILE_VALID_OPTION_FLAGS);

where dwOpenOptions is the CreateDisposition and should have the value FILE_OPEN in case of file open request.

It is working fine in case of create i.e FILE_CREATE.

But i am not getting the appropriate value for CreateDisposition (i.e. FILE_OPEN) in case of file open request.

Actually I am having a service running in background that continuously polls the filter driver and it gives me the notification for file/directory create, but not for file/directory open.

Can anyone tell me how to get notifications from driver for file/directory open in my service?

Thanks in Advance.

Contact brides & grooms FREE! Only on www.shaadi.com. Register now!

2

(For future reference, the correct forum for this question is ntfsd.)

Your code is correct, the bug must be somewhere else. You say you are
simply not seeing any creates for which dwOpenOptions is FILE_OPEN?

cheerful vishwanathan wrote:

I am developing a filter driver for a NT file system, and want to trap
FILE OPEN and DIRECTORY OPEN requests.

At present I am trapping IRP_MJ_CREATE for open request.
and using the following lines of source

DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >> 24) & 0xFF);

DWORD dwUserOptions = (pParms->Parameters.Create.Options &
FILE_VALID_OPTION_FLAGS);

where dwOpenOptions is the CreateDisposition and should have the value
FILE_OPEN in case of file open request.

It is working fine in case of create i.e FILE_CREATE.

But i am not getting the appropriate value for CreateDisposition (i.e.
FILE_OPEN) in case of file open request.

Actually I am having a service running in background that continuously
polls the filter driver and it gives me the notification for
file/directory create, but not for file/directory open.

Can anyone tell me how to get notifications from driver for
file/directory open in my service?

Thanks in Advance.

Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
http:

–
- Nick Ryan
- Microsoft MVP for DDK</http:>

3

Hi

Thanks for your help.

Now  I am getting FILE_OPEN, but there is an issue.

Suppose I have a file a.bmp, on clicking this file i do get the notification. But now if i

click the a.bmp again … I do not get the notification. But if after clicking a.bmp, now

i click another file suppose c.txt, notification for c.txt will come.

The problem is this that if i try to access the same file subsequently i am not getting the notifications.

Please help me.

Thanks in advance.

From: Nick Ryan

>Reply-To: “Windows System Software Devs Interest List”
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>Date: Mon, 09 Feb 2004 20:51:06 -0800
>
>(For future reference, the correct forum for this question is
>ntfsd.)
>
>Your code is correct, the bug must be somewhere else. You say you
>are simply not seeing any creates for which dwOpenOptions is
>FILE_OPEN?
>
>cheerful vishwanathan wrote:
>>
>>I am developing a filter driver for a NT file system, and want to
>>trap FILE OPEN and DIRECTORY OPEN requests.
>> At present I am trapping IRP_MJ_CREATE for open request.
>>and using the following lines of source
>> DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >> 24)
>>& 0xFF);
>>
>>DWORD dwUserOptions = (pParms->Parameters.Create.Options &
>>FILE_VALID_OPTION_FLAGS);
>>
>>where dwOpenOptions is the CreateDisposition and should have the
>>value FILE_OPEN in case of file open request.
>>
>>It is working fine in case of create i.e FILE_CREATE.
>>
>>But i am not getting the appropriate value for CreateDisposition
>>(i.e. FILE_OPEN) in case of file open request.
>>
>>Actually I am having a service running in background that
>>continuously polls the filter driver and it gives me the
>>notification for file/directory create, but not for file/directory
>>open.
>>
>>Can anyone tell me how to get notifications from driver for
>>file/directory open in my service?
>>
>>Thanks in Advance.
>>
>>
>>------------------------------------------------------------------------
>>Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
>><http: g.msn.com>
>
>–
>- Nick Ryan
>- Microsoft MVP for DDK
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to
>xxxxx@lists.osr.com
</http:>

Contact brides & grooms FREE! Only on www.shaadi.com. Register now!

4

Are you just ‘clicking’ on the file or are you actually opening it? :slight_smile: I
mean, if you’re opening the file again, another IRP_MJ_CREATE is being
sent down, period.

cheerful vishwanathan wrote:

Hi

Thanks for your help.

Now I am getting FILE_OPEN, but there is an issue.

Suppose I have a file a.bmp, on clicking this file i do get the
notification. But now if i

click the a.bmp again … I do not get the notification. But if after
clicking a.bmp, now

i click another file suppose c.txt, notification for c.txt will come.

The problem is this that if i try to access the same file subsequently i
am not getting the notifications.

Please help me.

Thanks in advance.

>From: Nick Ryan
>Reply-To: “Windows System Software Devs Interest List”
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>Date: Mon, 09 Feb 2004 20:51:06 -0800
>
>(For future reference, the correct forum for this question is
>ntfsd.)
>
>Your code is correct, the bug must be somewhere else. You say you
>are simply not seeing any creates for which dwOpenOptions is
>FILE_OPEN?
>
>cheerful vishwanathan wrote:
>>
>>I am developing a filter driver for a NT file system, and want to
>>trap FILE OPEN and DIRECTORY OPEN requests.
>> At present I am trapping IRP_MJ_CREATE for open request.
>>and using the following lines of source
>> DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >> 24)
>>& 0xFF);
>>
>>DWORD dwUserOptions = (pParms->Parameters.Create.Options &
>>FILE_VALID_OPTION_FLAGS);
>>
>>where dwOpenOptions is the CreateDisposition and should have the
>>value FILE_OPEN in case of file open request.
>>
>>It is working fine in case of create i.e FILE_CREATE.
>>
>>But i am not getting the appropriate value for CreateDisposition
>>(i.e. FILE_OPEN) in case of file open request.
>>
>>Actually I am having a service running in background that
>>continuously polls the filter driver and it gives me the
>>notification for file/directory create, but not for file/directory
>>open.
>>
>>Can anyone tell me how to get notifications from driver for
>>file/directory open in my service?
>>
>>Thanks in Advance.
>>
>>
>>------------------------------------------------------------------------
>>Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
>>
>
>–
>- Nick Ryan
>- Microsoft MVP for DDK
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to
>xxxxx@lists.osr.com

Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
http:

–
- Nick Ryan
- Microsoft MVP for DDK</http:>

5

I am double clicking the file from windows explorer(OS is windows XP), and on the subsequent click i am not getting the notification.

But if i am opening the file from command prompt i am getting the notifications properly even on the subsequent open request for the same file.

Viviek

From: Nick Ryan

>Reply-To: “Windows System Software Devs Interest List”
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>Date: Mon, 09 Feb 2004 23:43:26 -0800
>
>Are you just ‘clicking’ on the file or are you actually opening it?
>:) I mean, if you’re opening the file again, another IRP_MJ_CREATE
>is being sent down, period.
>
>cheerful vishwanathan wrote:
>
>>Hi
>>
>>Thanks for your help.
>>
>>Now I am getting FILE_OPEN, but there is an issue.
>>
>>Suppose I have a file a.bmp, on clicking this file i do get the
>>notification. But now if i
>>
>>click the a.bmp again … I do not get the notification. But if
>>after clicking a.bmp, now
>>
>>i click another file suppose c.txt, notification for c.txt will
>>come.
>>
>>The problem is this that if i try to access the same file
>>subsequently i am not getting the notifications.
>>
>>Please help me.
>>
>>Thanks in advance.
>>
>>
>>
>>
>>
>> >From: Nick Ryan
>> >Reply-To: “Windows System Software Devs Interest List”
>> >To: “Windows System Software Devs Interest List”
>> >Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>> >Date: Mon, 09 Feb 2004 20:51:06 -0800
>> >
>> >(For future reference, the correct forum for this question is
>> >ntfsd.)
>> >
>> >Your code is correct, the bug must be somewhere else. You say
>>you
>> >are simply not seeing any creates for which dwOpenOptions is
>> >FILE_OPEN?
>> >
>> >cheerful vishwanathan wrote:
>> >>
>> >>I am developing a filter driver for a NT file system, and want
>>to
>> >>trap FILE OPEN and DIRECTORY OPEN requests.
>> >> At present I am trapping IRP_MJ_CREATE for open request.
>> >>and using the following lines of source
>> >> DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >>
>>24)
>> >>& 0xFF);
>> >>
>> >>DWORD dwUserOptions = (pParms->Parameters.Create.Options &
>> >>FILE_VALID_OPTION_FLAGS);
>> >>
>> >>where dwOpenOptions is the CreateDisposition and should have
>>the
>> >>value FILE_OPEN in case of file open request.
>> >>
>> >>It is working fine in case of create i.e FILE_CREATE.
>> >>
>> >>But i am not getting the appropriate value for
>>CreateDisposition
>> >>(i.e. FILE_OPEN) in case of file open request.
>> >>
>> >>Actually I am having a service running in background that
>> >>continuously polls the filter driver and it gives me the
>> >>notification for file/directory create, but not for
>>file/directory
>> >>open.
>> >>
>> >>Can anyone tell me how to get notifications from driver for
>> >>file/directory open in my service?
>> >>
>> >>Thanks in Advance.
>> >>
>> >>
>>
>> >>------------------------------------------------------------------------
>> >>Contact brides & grooms FREE! Only on www.shaadi.com. Register
>>now!
>> >>
>> >
>> >–
>> >- Nick Ryan
>> >- Microsoft MVP for DDK
>> >
>> >—
>> >Questions? First check the Kernel Driver FAQ at
>> >http://www.osronline.com/article.cfm?id=256
>> >
>> >You are currently subscribed to ntdev as: xxxxx@hotmail.com
>> >To unsubscribe send a blank email to
>> >xxxxx@lists.osr.com
>>
>>------------------------------------------------------------------------
>>Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
>><http: g.msn.com>
>
>–
>- Nick Ryan
>- Microsoft MVP for DDK
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to
>xxxxx@lists.osr.com
</http:>

MSN Hotmail now on your Mobile phone. Click here.

6

Is the same application being launched each time to open the file? What
if you launch the app first and open the files from the app’s file open
dialog?

cheerful vishwanathan wrote:

I am double clicking the file from windows explorer(OS is windows XP),
and on the subsequent click i am not getting the notification.

But if i am opening the file from command prompt i am getting the
notifications properly even on the subsequent open request for the same
file.

Viviek

>From: Nick Ryan
>Reply-To: “Windows System Software Devs Interest List”
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>Date: Mon, 09 Feb 2004 23:43:26 -0800
>
>Are you just ‘clicking’ on the file or are you actually opening it?
>:) I mean, if you’re opening the file again, another IRP_MJ_CREATE
>is being sent down, period.
>
>cheerful vishwanathan wrote:
>
>>Hi
>>
>>Thanks for your help.
>>
>>Now I am getting FILE_OPEN, but there is an issue.
>>
>>Suppose I have a file a.bmp, on clicking this file i do get the
>>notification. But now if i
>>
>>click the a.bmp again … I do not get the notification. But if
>>after clicking a.bmp, now
>>
>>i click another file suppose c.txt, notification for c.txt will
>>come.
>>
>>The problem is this that if i try to access the same file
>>subsequently i am not getting the notifications.
>>
>>Please help me.
>>
>>Thanks in advance.
>>
>>
>>
>>
>>
>> >From: Nick Ryan
>> >Reply-To: “Windows System Software Devs Interest List”
>> >To: “Windows System Software Devs Interest List”
>> >Subject: Re:[ntdev] HELP - Unable to trap FILE_OPEN
>> >Date: Mon, 09 Feb 2004 20:51:06 -0800
>> >
>> >(For future reference, the correct forum for this question is
>> >ntfsd.)
>> >
>> >Your code is correct, the bug must be somewhere else. You say
>>you
>> >are simply not seeing any creates for which dwOpenOptions is
>> >FILE_OPEN?
>> >
>> >cheerful vishwanathan wrote:
>> >>
>> >>I am developing a filter driver for a NT file system, and want
>>to
>> >>trap FILE OPEN and DIRECTORY OPEN requests.
>> >> At present I am trapping IRP_MJ_CREATE for open request.
>> >>and using the following lines of source
>> >> DWORD dwOpenOptions = ((pParms->Parameters.Create.Options >>
>>24)
>> >>& 0xFF);
>> >>
>> >>DWORD dwUserOptions = (pParms->Parameters.Create.Options &
>> >>FILE_VALID_OPTION_FLAGS);
>> >>
>> >>where dwOpenOptions is the CreateDisposition and should have
>>the
>> >>value FILE_OPEN in case of file open request.
>> >>
>> >>It is working fine in case of create i.e FILE_CREATE.
>> >>
>> >>But i am not getting the appropriate value for
>>CreateDisposition
>> >>(i.e. FILE_OPEN) in case of file open request.
>> >>
>> >>Actually I am having a service running in background that
>> >>continuously polls the filter driver and it gives me the
>> >>notification for file/directory create, but not for
>>file/directory
>> >>open.
>> >>
>> >>Can anyone tell me how to get notifications from driver for
>> >>file/directory open in my service?
>> >>
>> >>Thanks in Advance.
>> >>
>> >>
>>
>>
>>------------------------------------------------------------------------
>> >>Contact brides & grooms FREE! Only on www.shaadi.com. Register
>>now!
>> >>
>> >
>> >–
>> >- Nick Ryan
>> >- Microsoft MVP for DDK
>> >
>> >—
>> >Questions? First check the Kernel Driver FAQ at
>> >http://www.osronline.com/article.cfm?id=256
>> >
>> >You are currently subscribed to ntdev as: xxxxx@hotmail.com
>> >To unsubscribe send a blank email to
>> >xxxxx@lists.osr.com
>>
>>------------------------------------------------------------------------
>>Contact brides & grooms FREE! Only on www.shaadi.com. Register now!
>>
>
>–
>- Nick Ryan
>- Microsoft MVP for DDK
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to
>xxxxx@lists.osr.com

MSN Hotmail now on your Mobile phone. Click here.
http:

–
- Nick Ryan
- Microsoft MVP for DDK</http:>