@Cal said:
From minispy of Windows driver samples, I was expecting my custom reparse point to be one of the element on the ECP list got from “FltGetEcpListFromCallbackData” in pre-create but unfortunately no (after I tried to run “minispy” on one of the file with custom reparse point).
- Shouldn’t my reparse point be one of the ECP?
- Is there a similar function available to determine whether my file has custom reparse points or not?
In PreCreate the file isn’t yet open so no one can possibly know if it has your reparse point or not.
About “FltAddOpenReparseEntry”, should I build an ECP list and call this function to add that in pre-create even when I am working with files without reparse points? I am confused how I can “call this in PreCreate to let NTFS know which reparse point I handle”.
If possible, please help with more details. Thank you.
You call FltAddOpenReparseEntry in PreCreate to indicate which reparse point you handle:
openReparseEntry->Size = sizeof(OPEN_REPARSE_LIST_ENTRY);
openReparseEntry->ReparseTag = IO_REPARSE_TAG_FOOOOO;
RtlCopyMemory(&openReparseEntry->ReparseGuid,
&GUID_REPARSE_TAG_FOOOOO,
sizeof(GUID));
status = FltAddOpenReparseEntry(FooGlobals.FilterHandle,
Data,
openReparseEntry);
if (!NT_SUCCESS(status)) {
FooTracePrint(ERROR, "FltAddOpenReparseEntry failed! 0x%x\n",
status);
goto Exit;
}
*CompletionContext = openReparseEntry;
And then in PostCreate you check to see if it was acknowledged:
if (!BooleanFlagOn(openReparseEntry->Flags,
OPEN_REPARSE_POINT_TAG_ENCOUNTERED)) {
//
// Did not encounter our reparse point
//
goto Exit;
}
No STATUS_REPARSE, no reissuing the I/O, etc.