How to use windows minifilter to change system behavior such as changing target volumn?

NTFSD
1

Hi, could WDK minifilter could change the volumn when I/O operation
occured? I want to use minifilter to filter IRP such as write or read,
and change their write or read target volumn (like change from C
volumn to D) just like that.

Could you give me some example of how to change the volumn when IRP
occured? I already read the WDK/swapbuffers, could it work for my
application? Such example could only filter the IRP and change the
write and read data buffer. Could it change the target volumn as well?
Does iopb->Instance will work? if so how?

Thank you!

2

You should change volume in create and not read/write.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Hi, could WDK minifilter could change the volumn when I/O operation
> occured? I want to use minifilter to filter IRP such as write or read,
> and change their write or read target volumn (like change from C
> volumn to D) just like that.
>
> Could you give me some example of how to change the volumn when IRP
> occured? I already read the WDK/swapbuffers, could it work for my
> application? Such example could only filter the IRP and change the
> write and read data buffer. Could it change the target volumn as well?
> Does iopb->Instance will work? if so how?
>
> Thank you!
>
>
>

3

So you mean change IRP_create, and do not filter IRP_write or
IRP_read, just let them passthrough?

Quoting “Maxim S. Shatskih” :

> You should change volume in create and not read/write.
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> wrote in message news:xxxxx@ntfsd…
>> Hi, could WDK minifilter could change the volumn when I/O operation
>> occured? I want to use minifilter to filter IRP such as write or read,
>> and change their write or read target volumn (like change from C
>> volumn to D) just like that.
>>
>> Could you give me some example of how to change the volumn when IRP
>> occured? I already read the WDK/swapbuffers, could it work for my
>> application? Such example could only filter the IRP and change the
>> write and read data buffer. Could it change the target volumn as well?
>> Does iopb->Instance will work? if so how?
>>
>> Thank you!
>>
>>
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

Actually, you can change the target volume for just one specific operation, by changing the FLT_IO_PARAMETER_BLOCK->TargetInstance (though you might also need to change FLT_IO_PARAMETER_BLOCK->TargetFileObject, depending on implementation). After changing these don’t forget to set the FLT_CALLBACK_DATA dirty (FltSetCallbackDataDirty()).

If you use this method then the FLT_INSTANCE you set TargetInstance to must be at the same altitude at the current instance (you can’t change the altitude by setting TargetInstance). Also you must pay attention to the number of IO_STACK_LOCATIONs on the original IRP, since it’s possible that the two instances are at different ‘heights’ in the device stack, but at the same altitude in the FltMgr altitude list.

However, could you please explain what you’re trying to do ? Are you trying to redirect all writes for a volume or all the writes for a specific file (or set of files) or just some writes ? If you’re actually going to redirect all the IO for a specific file (or handle to the file like if process X opens the file then all IO should go to this file on D:) then the method suggested by Maxim is the easier one.

Thanks,
Alex.

5

Really thanks your reply! I have already tried change both the
TargetInstance or TargetFileObject, it cause system crash down.

I think there is some error when I got the parameters of
TargetInstance and TargetFileObject. I want to ask how to get
TargetInstance from like D volumn etc… Could you please give me some
example to how to use the funcion?

I want to filter all the IO operation and redirect them from D volumn
to C volumn. Because we are constructing a new kind of Cache
architecture: Using SSD to cache data from the hard disk. So I need to
redirect the IO operation from the hard disk to the SSD memory.

Thank you for your reply, could you give me some example on how to get
the TargetInstance in the minifilter?

Quoting xxxxx@gmail.com:

Actually, you can change the target volume for just one specific
operation, by changing the FLT_IO_PARAMETER_BLOCK->TargetInstance
(though you might also need to change
FLT_IO_PARAMETER_BLOCK->TargetFileObject, depending on
implementation). After changing these don’t forget to set the
FLT_CALLBACK_DATA dirty (FltSetCallbackDataDirty()).

If you use this method then the FLT_INSTANCE you set TargetInstance
to must be at the same altitude at the current instance (you can’t
change the altitude by setting TargetInstance). Also you must pay
attention to the number of IO_STACK_LOCATIONs on the original IRP,
since it’s possible that the two instances are at different
‘heights’ in the device stack, but at the same altitude in the
FltMgr altitude list.

However, could you please explain what you’re trying to do ? Are you
trying to redirect all writes for a volume or all the writes for a
specific file (or set of files) or just some writes ? If you’re
actually going to redirect all the IO for a specific file (or handle
to the file like if process X opens the file then all IO should go
to this file on D:) then the method suggested by Maxim is the easier
one.

Thanks,
Alex.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Well, I can’t speak for the crash, I guess you didn’t set something up properly.

However, since you intend to redirect all IO for a certain file from one volume to another it may be easier just to use STATUS_REPARSE (see the SimRep sample in the WDK, except that you would reparse to a different volume) like Maxim suggested.

Thanks,
Alex.

7

I want to know how to get TargetInstance for each volumn?

I know iopb->targetInstance could redirection of IO operation, but how
to get the TargetInstance in the InstanceSetup() Funciton? I mean I
need do the following:

iopb->TargetInstance= Redirection_Instance;
FltSetCallbackDataDirty( Data );

But how to get Redirection_Instance at the beginning of the minifilter?

Quoting xxxxx@gmail.com:

Well, I can’t speak for the crash, I guess you didn’t set something
up properly.

However, since you intend to redirect all IO for a certain file from
one volume to another it may be easier just to use STATUS_REPARSE
(see the SimRep sample in the WDK, except that you would reparse to
a different volume) like Maxim suggested.

Thanks,
Alex.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

In the InstanceSetup function look at the FltObjects->Instance parameter.

Thanks,
Alex.

9

Really thanks your reply, I will try it out right away!

Quoting xxxxx@gmail.com:

In the InstanceSetup function look at the FltObjects->Instance parameter.

Thanks,
Alex.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer