How to find out all FileObjects from FsContext?

NTFSD
1

Hello,

Is it possible to find out/enumerate all FileObjects that share the same
FsContext in a filter driver?

Thanks in advance.

Regards,
Somnath

2

Hi Somnath,

a FSFD can do it by monitoring IRP_MJ_CREATE and building a list of
FO-FsContext relations. You’ll have to

  • fail FastIo Create requests
  • count FO references to clean up an FO as soon as there’s no open handle
    left
  • start the filter as early as possible to not miss some early IRP_MJ_CREATE

I have no idea how to enumerate the relation between FO and FsContext from
internal structures (your question implies this to me), but since this list
will change all the time I wouldn’t recommend to try that. You’ll have to
halt the system during enumerating the list each time to have a consistent
view.

Tobias

----- Original Message -----
From: “Somnath Kundu”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Saturday, June 28, 2003 9:14 AM
Subject: [ntfsd] How to find out all FileObjects from FsContext?

> Hello,
>
> Is it possible to find out/enumerate all FileObjects that share the same
> FsContext in a filter driver?
>
> Thanks in advance.
>
> Regards,
> Somnath
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Tobias wrote in message news:xxxxx@ntfsd…
>
> Hi Somnath,
>
> a FSFD can do it by monitoring IRP_MJ_CREATE and building a list of
> FO-FsContext relations. You’ll have to
> - fail FastIo Create requests
> - count FO references to clean up an FO as soon as there’s no open handle
> left
> - start the filter as early as possible to not miss some early
IRP_MJ_CREATE

Yes, I am already doing that in normal cases. But my problem is that in some
cases I need to find and track FileObjects of already opened files.

>
> I have no idea how to enumerate the relation between FO and FsContext from
> internal structures (your question implies this to me), but since this
list
> will change all the time I wouldn’t recommend to try that. You’ll have to
> halt the system during enumerating the list each time to have a consistent
> view.

I need to build a list FO-FsContext relations for file that is already
opened and possibly locked.

Is there any way to do that?

Regards,
Somnath

>
> Tobias
>
> ----- Original Message -----
> From: “Somnath Kundu”
> Newsgroups: ntfsd
> To: “File Systems Developers”
> Sent: Saturday, June 28, 2003 9:14 AM
> Subject: [ntfsd] How to find out all FileObjects from FsContext?
>
>
> > Hello,
> >
> > Is it possible to find out/enumerate all FileObjects that share the same
> > FsContext in a filter driver?
> >
> > Thanks in advance.
> >
> > Regards,
> > Somnath
> >
> >
>

4

Theoretically you could enumerate all open handles in all processes
(using various undocumented techniques), but this would not tell you
about file objects that have been cleaned-up but not closed yet (such as
those that can be held by Cc). There is no list of open file objects I
know about that is accessible to your driver.

  • Nick Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Somnath Kundu
Sent: Saturday, June 28, 2003 3:20 AM
To: File Systems Developers
Subject: [ntfsd] Re: How to find out all FileObjects from FsContext?

Tobias wrote in message news:xxxxx@ntfsd…
> >
> > Hi Somnath,
> >
> > a FSFD can do it by monitoring IRP_MJ_CREATE and building a list of
> > FO-FsContext relations. You’ll have to
> > - fail FastIo Create requests
> > - count FO references to clean up an FO as soon as there’s no open
> > handle left
> > - start the filter as early as possible to not miss some early
> IRP_MJ_CREATE
>
> Yes, I am already doing that in normal cases. But my problem
> is that in some cases I need to find and track FileObjects of
> already opened files.
>
> >
> > I have no idea how to enumerate the relation between FO and
> FsContext
> > from internal structures (your question implies this to
> me), but since
> > this
> list
> > will change all the time I wouldn’t recommend to try that.
> You’ll have
> > to halt the system during enumerating the list each time to have a
> > consistent view.
>
> I need to build a list FO-FsContext relations for file that
> is already opened and possibly locked.
>
> Is there any way to do that?
>
> Regards,
> Somnath
>
> >
> > Tobias
> >
> > ----- Original Message -----
> > From: “Somnath Kundu”
> > Newsgroups: ntfsd
> > To: “File Systems Developers”
> > Sent: Saturday, June 28, 2003 9:14 AM
> > Subject: [ntfsd] How to find out all FileObjects from FsContext?
> >
> >
> > > Hello,
> > >
> > > Is it possible to find out/enumerate all FileObjects that
> share the
> > > same FsContext in a filter driver?
> > >
> > > Thanks in advance.
> > >
> > > Regards,
> > > Somnath
> > >
> > >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>