Hi all,
in my filter I am trying to manage files created with IoCreateStreamFile.
My filter needs a list of files that are in a specific folder. Normally
I check the full path
in the IRP_MJ_CREATE. Since those FILE_OBJECT never goes through the
IRP_MJ_CREATE,
I have to check for them in other callbacks.
Do you think I can safely get the name of a file inside a IRP_MJ_READ or
IRP_MJ_WRITE?
My idea is to look for the flag FO_STREAM_FILE. Only if the flag is set,
I test the file because I know
it has not been created with IRP_MJ_CREATE.
Then I send a IRP_QUERY_INFORMATION to get the full path. My concern is
if this operation is valid.
In fact I found at least two cases where seems not work:
- occasionally I get a STATUS_BUFFER_OVERFLOW even if the buffer I use
is large enough to store the filename. - during the boot inside a IRP_MJ_READ, I get a BDS.
As an alternative, I could avoid to query the filename and use
information I already have. In fact, given a file in the list,
all files created with IoCreateStreamFile share the same *FsContext*. I
am not sure it work because if I receive a request
on the StreamFile once the original file has been closed, I probably
don’t have a reference to the FsContext anymore.
Do you have some suggestions to manage these files?
Thank you very much
Francesco
–
Francesco Garelli, Ph.D.