how to create a shadow device

NTFSD
1

when I create a Shadow Deivce?and how to use it .
or any information?

in sfilter .I need call ZwCreateFile in IRP_MJ_CREATE dispatch
but a old problem ! in windowsXP or later OS version,there is a function “IoCreateFileSpecifyDeviceObjectHint”
but Windows2000 was faild!..
thanks for everyone~

2

oh???sorry,My english is so bad .
the problem is :“how to create a shadow device and how to use it ??”

3

IoCreateFileSpecifyDeviceHint is available in later versions of Win2K (UR1
and later AFAIR). You will probably have to use MmGetSystemRoutineAddress
to use it.

Question 34 of http://www.osronline.com/article.cfm?article=17 may help you
some more on using shaodw device objects.

However it sounds as though you are starting out and in that case I would
urge you to look at writing a minifilter. FltMgr works for all versions
since Windows2K UR1 and later (in other words for every version which
supports IoCreateFileSpecifyDeviceHint). The API FltCreateFile and friends
will do all that you need.

Even if you have an existing filter it is not a huge job to convert it from
legacy to minifilter.

Rod

4

IoCreateFileSpecifyDeviceObjectHint is available in Windows 2000 SP4 +
URP1. To use it, you will need to dynamically obtain its address and
then call it.

While it is possible to build the parallel stack approach (which uses a
shadow device and then “injects” the IRP at the correct level) it is a
complicated approach - and fragile - all to support downlevel versions
of Windows 2000. My advice is to restrict your support to Windows 2000
SP4 + URP1 or later (e.g., anywhere you can run a mini-filter.)

Tony
OSR