How to use InitializeObjectAttributes during PostDirectoryControl in a relative way?

NTFSD
1

Hello,

at the callback routine of IRP_MJ_DIRECTORY_CONTROL (PostDirectoryControl)
of my minifilter driver I need to manipulate the return content of e.g. FileBothDirectoryInformation.
Therefor I need to open some of the files from the directory list of this directory.
Currently I build a FQPN by the directory name and the file name from the list and open with this the files (by FltCreateFile). This works so far.

Now I stumpled over the spec of InitializeObjectAttributes and the usage of the RootDirectory handle to adress a file relative.
I thought cool, but going in more details it looks not that easy.

a) Question upfront:
Will FltCreateFile be faster by using a relative adressed ObjectAttribute?

b) How to get the the needed RootDirectory handle?
The PostDirectoryControl provides a FileObject but not a handle.
And using ObOpenObjectByPointer will deadlock (like https://www.osronline.com/showthread.cfm?link=156417)

Any idea/help?

Norbert

2

I would say a relative open is slightly faster in some cases. There
would be quite a bit of code in the volume name parsing portion that
would be skipped as well as each component within the relative name.
That said, ObOpenObjectByPointer() is prone to dead locks in some
scenarios so the complications introduced might offset the slight
performance benefits.

As an alternative you could open the parent once, using FltCreateFile(),
to get the handle back that you would then use to perform the relative
opens on each of the children.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@graudata.com
To: “Windows File Systems Devs Interest List”
Sent: 7/14/2015 9:37:17 AM
Subject: [ntfsd] How to use InitializeObjectAttributes during
PostDirectoryControl in a relative way?

>Hello,
>
>at the callback routine of IRP_MJ_DIRECTORY_CONTROL
>(PostDirectoryControl)
>of my minifilter driver I need to manipulate the return content of e.g.
>FileBothDirectoryInformation.
>Therefor I need to open some of the files from the directory list of
>this directory.
>Currently I build a FQPN by the directory name and the file name from
>the list and open with this the files (by FltCreateFile). This works so
>far.
>
>Now I stumpled over the spec of InitializeObjectAttributes and the
>usage of the RootDirectory handle to adress a file relative.
>I thought cool, but going in more details it looks not that easy.
>
>a) Question upfront:
>Will FltCreateFile be faster by using a relative adressed
>ObjectAttribute?
>
>b) How to get the the needed RootDirectory handle?
>The PostDirectoryControl provides a FileObject but not a handle.
>And using ObOpenObjectByPointer will deadlock (like
>https://www.osronline.com/showthread.cfm?link=156417)
>
>Any idea/help?
>
>Norbert
>
>
>
>
>
>
>
>
>—
>NTFSD is sponsored by OSR
>
>OSR is hiring!! Info at http://www.osr.com/careers
>
>For our schedule of debugging and file system seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

3

Pete, thx for the fast response.
I will give it a try.
Hope to not run in some sharing violation and/or oplock issues. I will see.

I’m only wondering why the system doesn’t allow me or provide a mechanism to use the already open directory fileobject and work relative to it.