How can I get a Handle from a known FileObject?

NTFSD
1

Hello!
I want’t to judge whether a known FileObject is a directory or not in my
IRP_MJ_READ/WRITE case routine.
At present my mothed is: setup a new IRP with major function code
IRP_MJ_QUARY_INFORMATION, and then pass it to FSD for
FileStandardInfomation. When the IRP come back successfully, I can check the
result. But it does’t work well because it usually returns unsuccessfully
and always leads program to dump .
Now, I try to use ZwQuaryInformationFile routine, can it work? There need a
handle as one of the input parameters, how can I get the handle from the
FileObject?
Thanks:)

2

You should be able to get the roll your own irp to work; does for me. If you
want a handle then ObOpenObjectByPointer might be your best friend.

“Zhang Chong” wrote in message news:xxxxx@ntfsd…
> Hello!
> I want’t to judge whether a known FileObject is a directory or not in my
> IRP_MJ_READ/WRITE case routine.
> At present my mothed is: setup a new IRP with major function code
> IRP_MJ_QUARY_INFORMATION, and then pass it to FSD for
> FileStandardInfomation. When the IRP come back successfully, I can check
the
> result. But it does’t work well because it usually returns unsuccessfully
> and always leads program to dump .
> Now, I try to use ZwQuaryInformationFile routine, can it work? There need
a
> handle as one of the input parameters, how can I get the handle from the
> FileObject?
> Thanks:)
>
>
>
>

3

Thanks a lot!
But I can’t find any document of ObOpenObjectByPointer routine, can I use it
safely?
You’re right that I can control my own Irp, and this part of code I refer to
the FilemonQuaryFile as sample in Filemon. But I don’t know why it can’t
work fine!
Now, it seems that I’ve resolve the problem by mothed to check the return
result of ZwCreateDirectoryObject routine. I pass the FileObject->Filename
to the routine as one of its parameters and if it returns STATUS_SUCCESS,
the file object is a directory:)

“Lyndon J Clarke” дÈëÓʼþ news:xxxxx@ntfsd…
> You should be able to get the roll your own irp to work; does for me. If
you
> want a handle then ObOpenObjectByPointer might be your best friend.
>
> “Zhang Chong” wrote in message news:xxxxx@ntfsd…
> > Hello!
> > I want’t to judge whether a known FileObject is a directory or not in my
> > IRP_MJ_READ/WRITE case routine.
> > At present my mothed is: setup a new IRP with major function code
> > IRP_MJ_QUARY_INFORMATION, and then pass it to FSD for
> > FileStandardInfomation. When the IRP come back successfully, I can check
> the
> > result. But it does’t work well because it usually returns
unsuccessfully
> > and always leads program to dump .
> > Now, I try to use ZwQuaryInformationFile routine, can it work? There
need
> a
> > handle as one of the input parameters, how can I get the handle from the
> > FileObject?
> > Thanks:)
> >
> >
> >
> >
>
>
>

4

ObOpenObjectByPointer has been documented for at least the couple releases of the IFS Kit, so yes, it is safe to use.

Also, the FileSpy sample in the IFS Kit shows you how to generate a IRP_MJ_QUERY_INFORMATION irp on your own.

If you don’t have the most up-to-date IFS Kit (Server 2003 RTM, which has build environments and samples for W2K and XP as well), I strongly encourage you to get a copy. With each release we add more to the documentation.

Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zhang Chong
Sent: Thursday, July 22, 2004 9:59 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How can I get a Handle from a known FileObject?

Thanks a lot!
But I can’t find any document of ObOpenObjectByPointer routine, can I use it
safely?
You’re right that I can control my own Irp, and this part of code I refer to
the FilemonQuaryFile as sample in Filemon. But I don’t know why it can’t
work fine!
Now, it seems that I’ve resolve the problem by mothed to check the return
result of ZwCreateDirectoryObject routine. I pass the FileObject->Filename
to the routine as one of its parameters and if it returns STATUS_SUCCESS,
the file object is a directory:)

“Lyndon J Clarke” д???ʼ? news:xxxxx@ntfsd…
> You should be able to get the roll your own irp to work; does for me. If
you
> want a handle then ObOpenObjectByPointer might be your best friend.
>
> “Zhang Chong” wrote in message news:xxxxx@ntfsd…
> > Hello!
> > I want’t to judge whether a known FileObject is a directory or not in my
> > IRP_MJ_READ/WRITE case routine.
> > At present my mothed is: setup a new IRP with major function code
> > IRP_MJ_QUARY_INFORMATION, and then pass it to FSD for
> > FileStandardInfomation. When the IRP come back successfully, I can check
> the
> > result. But it does’t work well because it usually returns
unsuccessfully
> > and always leads program to dump .
> > Now, I try to use ZwQuaryInformationFile routine, can it work? There
need
> a
> > handle as one of the input parameters, how can I get the handle from the
> > FileObject?
> > Thanks:)
> >
> >
> >
> >
>
>
>

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com