How to substitute a file object

NTFSD
1

Hello,

My minifilter needs to substitue the current file object by another file
object created by ZwCreateFile.
But the code gets Bug Checked. Is the following code correct?
Thanks for your valuable input. - Shangwu

Here is the code in post-create-callback when STATUS_REPARSE is set.

//Initial object attributes
RtlInitUnicodeString(&tgtName, tgtFileNameBuf); // tgtFileNameBuf likes
“??\UNC\server\dir”
InitializeObjectAttributes(&objAttr, &tgtName, OBJ_KERNEL_HANDLE, NULL,
NULL);
status = ZwCreateFile( &hTgtDir,
Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess,
&objAttr, &ioSt,
&Data->Iopb->Parameters.Create.AllocationSize,
Data->Iopb->Parameters.Create.FileAttributes,
Data->Iopb->Parameters.Create.ShareAccess,
(Data->Iopb->Parameters.Create.Options >> 24) & 0xFF,
Data->Iopb->Parameters.Create.Options,
Data->Iopb->Parameters.Create.EaBuffer,
Data->Iopb->Parameters.Create.EaLength );
// Release target name buffer
ExFreePool( tgtFileNameBuf );
// check FltCreateFileEx return status
if (NT_SUCCESS(status))
{
// Get the file object by the handle
status = ObReferenceObjectByHandle( hTgtDir, 0, NULL, KernelMode,
&pFoTgt, NULL);
ZwClose(hTgtDir); // release the handle

if (NT_SUCCESS(status))
{
// Release the current file object and return this new file
object
FltSetCallbackDataDirty( Data );
ObDereferenceObject( Data->Iopb->TargetFileObject );
Data->Iopb->TargetFileObject = pFoTgt;

Data->IoStatus.Status = ioSt.Status;
Data->IoStatus.Information = ioSt.Information;
}
}

2

First, you don’t return a new fileobject when you want to return
STATUS_REPARSE, only update the filename and return it. Second, post-create
is too late to return STATUS_REPARSE unless the cancel the current open that
has already occurred.

What is it you are attempting to do?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Thursday, December 14, 2006 3:27 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to substitute a file object

Hello,

My minifilter needs to substitue the current file object by another file
object created by ZwCreateFile.
But the code gets Bug Checked. Is the following code correct?
Thanks for your valuable input. - Shangwu

Here is the code in post-create-callback when STATUS_REPARSE is set.

//Initial object attributes
RtlInitUnicodeString(&tgtName, tgtFileNameBuf); // tgtFileNameBuf likes
“??\UNC\server\dir”
InitializeObjectAttributes(&objAttr, &tgtName, OBJ_KERNEL_HANDLE, NULL,
NULL);
status = ZwCreateFile( &hTgtDir,

Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess,
&objAttr, &ioSt,
&Data->Iopb->Parameters.Create.AllocationSize,
Data->Iopb->Parameters.Create.FileAttributes,
Data->Iopb->Parameters.Create.ShareAccess,
(Data->Iopb->Parameters.Create.Options >> 24) & 0xFF,
Data->Iopb->Parameters.Create.Options,
Data->Iopb->Parameters.Create.EaBuffer,
Data->Iopb->Parameters.Create.EaLength );
// Release target name buffer
ExFreePool( tgtFileNameBuf );
// check FltCreateFileEx return status
if (NT_SUCCESS(status))
{
// Get the file object by the handle
status = ObReferenceObjectByHandle( hTgtDir, 0, NULL, KernelMode,
&pFoTgt, NULL);
ZwClose(hTgtDir); // release the handle

if (NT_SUCCESS(status))
{
// Release the current file object and return this new file
object
FltSetCallbackDataDirty( Data );
ObDereferenceObject( Data->Iopb->TargetFileObject );
Data->Iopb->TargetFileObject = pFoTgt;

Data->IoStatus.Status = ioSt.Status;
Data->IoStatus.Information = ioSt.Information;
}
}

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Peter,

Thanks for your input. My minifilter actually returns STATUS_SUCCESS to its
upper instances after it receives STATUS_REPARSE and successfully gets a
FileObject from ZwCreateFile.
My minifilter tries to redirect an access for a local directory to a network
shared directory on another server. Returning STATUS_REPARSE only works for
requests coming from the local processes. It does not work in some cases
where lanmanredirector is involved. It seems lanmanredirector caches some
paths locally.
I am not sure whether it is correct to replace the current file object by
another file object that is created by ZwCreateFile.

Thanks.

“Peter Scott” wrote in message
news:xxxxx@ntfsd…
>
> First, you don’t return a new fileobject when you want to return
> STATUS_REPARSE, only update the filename and return it. Second,
> post-create
> is too late to return STATUS_REPARSE unless the cancel the current open
> that
> has already occurred.
>
> What is it you are attempting to do?
>
> Pete
>
> Kernel Drivers
> Windows Filesystem and Device Driver Consulting
> www.KernelDrivers.com
> (303)546-0300
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
> Sent: Thursday, December 14, 2006 3:27 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to substitute a file object
>
> Hello,
>
> My minifilter needs to substitue the current file object by another file
> object created by ZwCreateFile.
> But the code gets Bug Checked. Is the following code correct?
> Thanks for your valuable input. - Shangwu
>
> Here is the code in post-create-callback when STATUS_REPARSE is set.
>
> //Initial object attributes
> RtlInitUnicodeString(&tgtName, tgtFileNameBuf); // tgtFileNameBuf likes
> “??\UNC\server\dir”
> InitializeObjectAttributes(&objAttr, &tgtName, OBJ_KERNEL_HANDLE, NULL,
> NULL);
> status = ZwCreateFile( &hTgtDir,
>
> Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess,
> &objAttr, &ioSt,
> &Data->Iopb->Parameters.Create.AllocationSize,
> Data->Iopb->Parameters.Create.FileAttributes,
> Data->Iopb->Parameters.Create.ShareAccess,
> (Data->Iopb->Parameters.Create.Options >> 24) & 0xFF,
> Data->Iopb->Parameters.Create.Options,
> Data->Iopb->Parameters.Create.EaBuffer,
> Data->Iopb->Parameters.Create.EaLength );
> // Release target name buffer
> ExFreePool( tgtFileNameBuf );
> // check FltCreateFileEx return status
> if (NT_SUCCESS(status))
> {
> // Get the file object by the handle
> status = ObReferenceObjectByHandle( hTgtDir, 0, NULL, KernelMode,
> &pFoTgt, NULL);
> ZwClose(hTgtDir); // release the handle
>
> if (NT_SUCCESS(status))
> {
> // Release the current file object and return this new file
> object
> FltSetCallbackDataDirty( Data );
> ObDereferenceObject( Data->Iopb->TargetFileObject );
> Data->Iopb->TargetFileObject = pFoTgt;
>
> Data->IoStatus.Status = ioSt.Status;
> Data->IoStatus.Information = ioSt.Information;
> }
> }
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>