How can I solve the problem?

Hi All,

I am writing a FS filter driver base the filespy sample,and I want to Let
user see the drive letters, but prevent the volumes from mounting.

The following is my code,

But failed,why?

NTSTATUS
SpyCreate(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
ULONG status = STATUS_SUCCESS;
PIO_STACK_LOCATION pIrpStack;
KIRQL oldIrql;

if (DeviceObject == gControlDeviceObject) {
//
// A CREATE request is being made on our gControlDeviceObject
//
ExAcquireSpinLock( &gControlDeviceStateLock, &oldIrql );
if (gControlDeviceState != CLOSED) {
status = STATUS_DEVICE_ALREADY_ATTACHED;
} else {
gControlDeviceState = OPENED;
}
ExReleaseSpinLock( &gControlDeviceStateLock, oldIrql );

//
// Since this is our gControlDeviceObject, we complete the
// irp here.
//
Irp->IoStatus.Status = status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return status;
}

Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest (Irp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}

regards,

sailing_an

Just my opinion…

  1. Check current IRQL before calling ExAcquireSpinLock;
  2. Because IRQL is reset to DISPATCH_LEVEL by ExAcquireSpinLock you
    must be sure that your SpyCreate is in NonPageed memory;
  3. Spin lock (gControlDeviceStateLock) must neither be pageable nor make any references to
    pageable data;
  4. Use KeAcquireSpinLock;

What kind of error occures exactly?

Michael

b> Hi All,

b> I am writing a FS filter driver base the filespy sample,and I want to Let
b> user see the drive letters, but prevent the volumes from mounting.

b> The following is my code,

b> But failed,why?

b> NTSTATUS
b> SpyCreate(
b> IN PDEVICE_OBJECT DeviceObject,
b> IN PIRP Irp
b> )
b> {
b> ULONG status = STATUS_SUCCESS;
b> PIO_STACK_LOCATION pIrpStack;
b> KIRQL oldIrql;

b> if (DeviceObject == gControlDeviceObject) {
b> //
b> // A CREATE request is being made on our gControlDeviceObject
b> //
b> ExAcquireSpinLock( &gControlDeviceStateLock, &oldIrql );
b> if (gControlDeviceState != CLOSED) {
b> status = STATUS_DEVICE_ALREADY_ATTACHED;
b> } else {
b> gControlDeviceState = OPENED;
b> }
b> ExReleaseSpinLock( &gControlDeviceStateLock, oldIrql );

b> //
b> // Since this is our gControlDeviceObject, we complete the
b> // irp here.
b> //
b> Irp->IoStatus.Status = status;
b> IoCompleteRequest( Irp, IO_NO_INCREMENT );
b> return status;
b> }

b> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
b> IoCompleteRequest (Irp, IO_NO_INCREMENT);
b> return STATUS_ACCESS_DENIED;
b> }

b> regards,

b> sailing_an

b> —
b> You are currently subscribed to ntfsd as: xxxxx@nadatel.com
b> To unsubscribe send a blank email to xxxxx@lists.osr.com


Best regards,
Michael mailto:xxxxx@nadatel.com

I think you must fail mount requests, i.e.
IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_MOUNT_VOLUME request.

-htfv

----- Original Message -----
From: “beginner_an”
To: “File Systems Developers”
Sent: Tuesday, June 24, 2003 10:18 AM
Subject: [ntfsd] How can I solve the problem?

> Hi All,
>
> I am writing a FS filter driver base the filespy sample,and I want to Let
> user see the drive letters, but prevent the volumes from mounting.
>
> The following is my code,
>
> But failed,why?
>
> NTSTATUS
> SpyCreate(
> IN PDEVICE_OBJECT DeviceObject,
> IN PIRP Irp
> )
> {
> ULONG status = STATUS_SUCCESS;
> PIO_STACK_LOCATION pIrpStack;
> KIRQL oldIrql;
>
> if (DeviceObject == gControlDeviceObject) {
> //
> // A CREATE request is being made on our gControlDeviceObject
> //
> ExAcquireSpinLock( &gControlDeviceStateLock, &oldIrql );
> if (gControlDeviceState != CLOSED) {
> status = STATUS_DEVICE_ALREADY_ATTACHED;
> } else {
> gControlDeviceState = OPENED;
> }
> ExReleaseSpinLock( &gControlDeviceStateLock, oldIrql );
>
> //
> // Since this is our gControlDeviceObject, we complete the
> // irp here.
> //
> Irp->IoStatus.Status = status;
> IoCompleteRequest( Irp, IO_NO_INCREMENT );
> return status;
> }
>
> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
> IoCompleteRequest (Irp, IO_NO_INCREMENT);
> return STATUS_ACCESS_DENIED;
> }
>
> regards,
>
> sailing_an
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

Hi Michael,

Thank you for your reply.but no effect.

regards,

sailing_an

Hi Alexei,

Thank you for your advice!

If I Allow the volumes to mount, but prevent him from opening driver
letters,Can you help me to solve the problem?

Regards,

sailing_an