How to use FltAllocateCallbackData & FltPerformSynchronousIo to open a file?

Ayush_Gupta-2 · August 6, 2007, 5:41am

Hi!

In my minifilter, I have to use FltAllocateCallbackData and then
FltPerformSynchronousIo to open a file using File ID.

I am using these functions because I am not at PASSIVE_LEVEL, so I cannot
use FltCreateFile. Of course I am issuing these calls when I am not in a
Paging I/O path and TopLevelIrp = NULL.

I am doing the following in my routine:

Declaring a pointer to file object and allocating memory to it. And
then zeroing out the contents of file object.
Allocating memory to the FileName buffer and then assigning it to
the File ID of the file that I wish to open.
Allocating Callbackdata using FltAllocateCallbackData. I am passing
both the instance & file object.
The call to FltAllocateCallbackData is succeeding.
Then I am initializing the parameters of Callbackdata:

a. MajorFunction = IRP_MJ_CREATE

b. IrpFlags = IRP_SYNCHRONOUS_API

c. Parameters.Create.Options = FILE_OPEN | FILE_OPEN_BY_FILE_ID

d. Allocating memory and assigning
Parameters.Create.SecurityContext->DesiredAccess = GENERIC_READ |
GENERIC_WRITE

Calling FltPerformSynchronousIo.

However, the IoStatus.Status contains the value STATUS_INVALID_PARAMETER.

I wanted to know the following:

Which parameter have I passed wrong?
Do I need to pass any other parameters?

Thanks!

Ayush Gupta

K7 Computing Pvt. Ltd.

http: www.k7computing.com</http:>

Ayush_Gupta-2 · August 6, 2007, 9:33am

Hi!

I think the problem is with the File Object that I am passing.

I was going through the NTFSD list and happened to see a function :
ObCreateObject.

Basically, this is an extra overhead for rolling a IRP_MJ_CREATE
irp/callbackdata.

But is this ok to use this function? Because it is undocumented.

Is there any other way out to do this?

Thanks!

Ayush Gupta

K7 Computing Pvt. Ltd.

http: www.k7computing.com

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Monday, August 06, 2007 3:11 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to use FltAllocateCallbackData &
FltPerformSynchronousIo to open a file?

Hi!

In my minifilter, I have to use FltAllocateCallbackData and then
FltPerformSynchronousIo to open a file using File ID.

I am using these functions because I am not at PASSIVE_LEVEL, so I cannot
use FltCreateFile. Of course I am issuing these calls when I am not in a
Paging I/O path and TopLevelIrp = NULL.

I am doing the following in my routine:

1. Declaring a pointer to file object and allocating memory to it. And
then zeroing out the contents of file object.

2. Allocating memory to the FileName buffer and then assigning it to
the File ID of the file that I wish to open.

3. Allocating Callbackdata using FltAllocateCallbackData. I am passing
both the instance & file object.

4. The call to FltAllocateCallbackData is succeeding.

5. Then I am initializing the parameters of Callbackdata:

a. MajorFunction = IRP_MJ_CREATE

b. IrpFlags = IRP_SYNCHRONOUS_API

c. Parameters.Create.Options = FILE_OPEN | FILE_OPEN_BY_FILE_ID

d. Allocating memory and assigning
Parameters.Create.SecurityContext->DesiredAccess = GENERIC_READ |
GENERIC_WRITE

6. Calling FltPerformSynchronousIo.

However, the IoStatus.Status contains the value STATUS_INVALID_PARAMETER.

I wanted to know the following:

1. Which parameter have I passed wrong?

2. Do I need to pass any other parameters?

Thanks!

Ayush Gupta

K7 Computing Pvt. Ltd.

http: www.k7computing.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></http:>

Don_Burn_1 · August 6, 2007, 9:49am

Well besides the fact that using the undocumented functions are stupid, you
will not get anywhere because ObCreateObject only works at PASSIVE_LEVEL so
you are not gaining a thing.

You are going to have to reorganize your code to do the Create at passive
level. You have not given enough context to comment exactly how badly
broken your design is.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Ayush Gupta” wrote in message news:xxxxx@ntfsd…
> Hi!
>
>
>
> I think the problem is with the File Object that I am passing.
>
> I was going through the NTFSD list and happened to see a function :
> ObCreateObject.
>
> Basically, this is an extra overhead for rolling a IRP_MJ_CREATE
> irp/callbackdata.
>
>
>
> But is this ok to use this function? Because it is undocumented.
>
> Is there any other way out to do this?
>
>
>
> Thanks!
>
>
>
> Ayush Gupta
>
> K7 Computing Pvt. Ltd.
>
> http: www.k7computing.com
>
>
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
> Sent: Monday, August 06, 2007 3:11 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to use FltAllocateCallbackData &
> FltPerformSynchronousIo to open a file?
>
>
>
> Hi!
>
>
>
> In my minifilter, I have to use FltAllocateCallbackData and then
> FltPerformSynchronousIo to open a file using File ID.
>
> I am using these functions because I am not at PASSIVE_LEVEL, so I cannot
> use FltCreateFile. Of course I am issuing these calls when I am not in a
> Paging I/O path and TopLevelIrp = NULL.
>
>
>
> I am doing the following in my routine:
>
> 1. Declaring a pointer to file object and allocating memory to it.
> And
> then zeroing out the contents of file object.
>
> 2. Allocating memory to the FileName buffer and then assigning it to
> the File ID of the file that I wish to open.
>
> 3. Allocating Callbackdata using FltAllocateCallbackData. I am
> passing
> both the instance & file object.
>
> 4. The call to FltAllocateCallbackData is succeeding.
>
> 5. Then I am initializing the parameters of Callbackdata:
>
> a. MajorFunction = IRP_MJ_CREATE
>
> b. IrpFlags = IRP_SYNCHRONOUS_API
>
> c. Parameters.Create.Options = FILE_OPEN | FILE_OPEN_BY_FILE_ID
>
> d. Allocating memory and assigning
> Parameters.Create.SecurityContext->DesiredAccess = GENERIC_READ |
> GENERIC_WRITE
>
> 6. Calling FltPerformSynchronousIo.
>
>
>
> However, the IoStatus.Status contains the value STATUS_INVALID_PARAMETER.
>
>
>
> I wanted to know the following:
>
>
>
> 1. Which parameter have I passed wrong?
>
> 2. Do I need to pass any other parameters?
>
>
>
>
>
> Thanks!
>
>
>
> Ayush Gupta
>
> K7 Computing Pvt. Ltd.
>
> http: www.k7computing.com
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
> ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
></http:></http:>

Ayush_Gupta-2 · August 6, 2007, 10:06am

Hey thanks Don!

I have still not designed the stuff. Just trying to figure out various ways
of doing a particular thing.
Basically, the objective is to add the checksum of the file and some other
information at the end of the file (stream) when I receive StreamContext
cleanup for that stream.

In this context, I want to ask some more questions:
Here is the scenario:
Suppose I don’t allow unloading of my minifilter ( of course I will in case
of MANDATORY UNLOAD and I suppose it comes only at the time of shut down ),
and I receive a stream context cleanup. I am talking about STREAM CONTEXT
and NOT STREAM HANDLE CONTEXT.

Is it safe to assume that there are no more references to that stream?
And Even the cache manager has no reference to it?
What happens first during shutdown: Unloading of minifilter OR flushing
of data and dereferencing of file objects by the cache manager?

Thanks!

Ayush Gupta
K7 Computing Pvt. Ltd.
www.k7computing.com

Frank_Friemel · August 7, 2007, 11:10am

you’re the guy xxxxx@yahoo.co.in, aren’t you?
“Ayush Gupta” schrieb im Newsbeitrag news:xxxxx@ntfsd…
Hi!

In my minifilter, I have to use FltAllocateCallbackData and then FltPerformSynchronousIo to open a file using File ID.

I am using these functions because I am not at PASSIVE_LEVEL, so I cannot use FltCreateFile. Of course I am issuing these calls when I am not in a Paging I/O path and TopLevelIrp = NULL.

I am doing the following in my routine:

1. Declaring a pointer to file object and allocating memory to it. And then zeroing out the contents of file object.

2. Allocating memory to the FileName buffer and then assigning it to the File ID of the file that I wish to open.

3. Allocating Callbackdata using FltAllocateCallbackData. I am passing both the instance & file object.

4. The call to FltAllocateCallbackData is succeeding.

5. Then I am initializing the parameters of Callbackdata:

a. MajorFunction = IRP_MJ_CREATE

b. IrpFlags = IRP_SYNCHRONOUS_API

c. Parameters.Create.Options = FILE_OPEN | FILE_OPEN_BY_FILE_ID

d. Allocating memory and assigning Parameters.Create.SecurityContext->DesiredAccess = GENERIC_READ | GENERIC_WRITE

6. Calling FltPerformSynchronousIo.

However, the IoStatus.Status contains the value STATUS_INVALID_PARAMETER.

I wanted to know the following:

1. Which parameter have I passed wrong?

2. Do I need to pass any other parameters?

Thanks!

Ayush Gupta

K7 Computing Pvt. Ltd.

www.k7computing.com