I can’t call ZwClose directly,it will result that other filter do
something recursively.
I want to implement ZwClose myself.Just Roll my IRP to lower.
I think it is :
Roll an IRP_MJ_CLEANUP to lower.
ObDereference(fileobject);
It can work?
and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
Thank you for help.
You pretty much cant do this. You must destroy the handle, and you cant get
access to process handle tables in any way.
Dan
----- Original Message -----
From: “ecore”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, October 02, 2003 1:49 PM
Subject: [ntfsd] How to implement ZwClose
> I can’t call ZwClose directly,it will result that other filter do
> something recursively.
> I want to implement ZwClose myself.Just Roll my IRP to lower.
> I think it is :
> Roll an IRP_MJ_CLEANUP to lower.
> ObDereference(fileobject);
>
> It can work?
> and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
> Thank you for help.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
You can’t do that. First of all, IRP_MJ_CLEANUP/IRP_MJ_CLOSE must go through
all devices which have seen IRP_MJ_CREATE to give them possibility to do
cleanup. Second, as Dan Partelly already mentioned, you must call ZwClose to
destroy handle.
-htfv
“ecore” wrote in message news:xxxxx@ntfsd…
>
> I can’t call ZwClose directly,it will result that other filter do
> something recursively.
> I want to implement ZwClose myself.Just Roll my IRP to lower.
> I think it is :
> Roll an IRP_MJ_CLEANUP to lower.
> ObDereference(fileobject);
>
> It can work?
> and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
> Thank you for help.
>
>
OK.
if I roll my IRP_MJ_CREATE(GOD!) to lower,and I roll my read to lower,
and I roll my Cleanup to lower.At last,I obDereference(not roll
IRP_MJ_CLOSE).
it can work.right?
although it is so difficult.
You can’t do that. First of all, IRP_MJ_CLEANUP/IRP_MJ_CLOSE must go through
all devices which have seen IRP_MJ_CREATE to give them possibility to do
cleanup. Second, as Dan Partelly already mentioned, you must call ZwClose to
destroy handle.-htfv
“ecore” wrote in message news:xxxxx@ntfsd…
> >
> > I can’t call ZwClose directly,it will result that other filter do
> > something recursively.
> > I want to implement ZwClose myself.Just Roll my IRP to lower.
> > I think it is :
> > Roll an IRP_MJ_CLEANUP to lower.
> > ObDereference(fileobject);
> >
> > It can work?
> > and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
> > Thank you for help.
> >
> >
you might get away with this, as long as you roll your own create, and never
request a handle for this file from Ob manager. You dont have any way to
destroy that handle yourself , simulating perfectly a ZwClose(). But most
likely you do not need such artefacts, maybe if you tell us what you are
trying to accomplish, we can fix your design.
Dan
----- Original Message -----
From: “ecore”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, October 02, 2003 4:11 PM
Subject: [ntfsd] Re: How to implement ZwClose
> OK.
> if I roll my IRP_MJ_CREATE(GOD!) to lower,and I roll my read to lower,
> and I roll my Cleanup to lower.At last,I obDereference(not roll
> IRP_MJ_CLOSE).
> it can work.right?
> although it is so difficult.
>
> > You can’t do that. First of all, IRP_MJ_CLEANUP/IRP_MJ_CLOSE must go
through
> > all devices which have seen IRP_MJ_CREATE to give them possibility to do
> > cleanup. Second, as Dan Partelly already mentioned, you must call
ZwClose to
> > destroy handle.
> >
> > -htfv
> >
> >
> >
> > “ecore” wrote in message news:xxxxx@ntfsd…
> > >
> > > I can’t call ZwClose directly,it will result that other filter do
> > > something recursively.
> > > I want to implement ZwClose myself.Just Roll my IRP to lower.
> > > I think it is :
> > > Roll an IRP_MJ_CLEANUP to lower.
> > > ObDereference(fileobject);
> > >
> > > It can work?
> > > and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
> > > Thank you for help.
> > >
> > >
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thanks Dan.
I developped my filter.It works well.but,interoperation with other filters
is very terrible.
just like ifsfaq#34,I use MyShadowDO to implement
IoCreateFileSpecifyDeviceObjectHint.it works well—Opening files during
IRP_MJ_CREATE processing.
But some filter will Opening files during IRP_MJ_CLEANUP processing.
Oh,I will call ZwClose during IRP_MJ_CREATE processing.So,recursively.
Just look my newly issue,that’s about this question.
Thanks Dan.Thanks for your reply.
you might get away with this, as long as you roll your own create, and never
request a handle for this file from Ob manager. You dont have any way to
destroy that handle yourself , simulating perfectly a ZwClose(). But most
likely you do not need such artefacts, maybe if you tell us what you are
trying to accomplish, we can fix your design.Dan
----- Original Message -----
From: “ecore”
> To: “Windows File Systems Devs Interest List”
> Sent: Thursday, October 02, 2003 4:11 PM
> Subject: [ntfsd] Re: How to implement ZwClose
>
>
> > OK.
> > if I roll my IRP_MJ_CREATE(GOD!) to lower,and I roll my read to lower,
> > and I roll my Cleanup to lower.At last,I obDereference(not roll
> > IRP_MJ_CLOSE).
> > it can work.right?
> > although it is so difficult.
> >
> > > You can’t do that. First of all, IRP_MJ_CLEANUP/IRP_MJ_CLOSE must go
> through
> > > all devices which have seen IRP_MJ_CREATE to give them possibility to do
> > > cleanup. Second, as Dan Partelly already mentioned, you must call
> ZwClose to
> > > destroy handle.
> > >
> > > -htfv
> > >
> > >
> > >
> > > “ecore” wrote in message news:xxxxx@ntfsd…
> > > >
> > > > I can’t call ZwClose directly,it will result that other filter do
> > > > something recursively.
> > > > I want to implement ZwClose myself.Just Roll my IRP to lower.
> > > > I think it is :
> > > > Roll an IRP_MJ_CLEANUP to lower.
> > > > ObDereference(fileobject);
> > > >
> > > > It can work?
> > > > and how to construct an IRP_MJ_CLEANUP IRP?there is no document.
> > > > Thank you for help.
> > > >
> > > >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >