How to set the parameters of FsSimpleOpen ?

NTFSD
1

Does anybody try the following function

NTSTATUS FsSimpleOpen(PUNICODE_STRING pstrName, ACCESS_MASK DesiredAccess,
PDEVICE_OBJECT pVolume, PDEVICE_OBJECT pRealDevice, PFILE_OBJECT pParent,
PFILE_OBJECT *ppFile);

which was contributed by Jonathan Borden in the Message of “RE: Question
on preventing my driver from filtering it’s-own transactions…” on Feb
14, 2001 ?

What are the pVolume, pRealDevice and pParent ?

Currently, I’m using Filemon as the base. How can I get values for the
above three parameters ? It would be the greatest, if someone can give
sample code of calling the mentioned function.

Thanks & Regards,

– Philip

2

pVolume is the driver at the bottom of the file system stack, pParent
should be the driver at the top of the FS stack,
pRealDevice should be the FILE_DEVICE_DISK on which the volume is mounted.
The only clean & secure way to get the
real device is to actually intercept the mount operation. Filemon isn’t a
very well written filter driver , rather is hacked in to work & compile
whithout the IFS kit, and I dont think it provides for you any ways to get
the real device. Rather I think it opens the root directory of drives in
sequence , like A:\ , B:\ … etc , which means it has no support for file
systems mounted but whithout any drive letter assignment.

Anyway, there are simpler methods to filter out a create operation than
using that code, several where outlined many times on this list.

----- Original Message -----
From: “Philip Hong”
To: “File Systems Developers”
Sent: Tuesday, March 05, 2002 6:51 PM
Subject: [ntfsd] How to set the parameters of FsSimpleOpen ?

> Does anybody try the following function
>
> NTSTATUS FsSimpleOpen(PUNICODE_STRING pstrName, ACCESS_MASK DesiredAccess,
> PDEVICE_OBJECT pVolume, PDEVICE_OBJECT pRealDevice, PFILE_OBJECT pParent,
> PFILE_OBJECT *ppFile);
>
> which was contributed by Jonathan Borden in the Message of “RE: Question
> on preventing my driver from filtering it’s-own transactions…” on Feb
> 14, 2001 ?
>
> What are the pVolume, pRealDevice and pParent ?
>
> Currently, I’m using Filemon as the base. How can I get values for the
> above three parameters ? It would be the greatest, if someone can give
> sample code of calling the mentioned function.
>
> Thanks & Regards,
>
> – Philip
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>