I attached some data in front of original file. and....

NTFSD
1

i attached some data in front of original file.
the data has the length, some key data for the origianl file.
and the data size is 4096bytes.
when a certain application reads that file,
my filter driver checks the data i has attached first.
and if the length and key are valid, my filter driver
allows the application to read original data from the file…

i am eager to realize this routine.

i thought like this;

  • when filter driver gets IRP_MJ_CREATE, i make filter driver to try
  • to read the 4096bytes data.

but i cannot read the data. is it right?

please advise me…

2

Hello,

In case you want to check this(to read from file the data block and make
some checks over it… blah blah) when trying to Open a file, you should
be able to make it from IRP_MJ_CREATE. Use ZwXxxxx functions to read the
data you need from the file. These functocions work only if you’re at
IRQL = PASSIVE_LEVEL. If not… I’m sorry. After doing this If the data
block satisfies YOUR condition just forward the request to the next
level. If not just return… I don’t know… STATUS_UNSUCCESSFUL… or I
think this one should be ok: STATUS_LOCK_NOT_GRANTED.
Now, when you do a normal reading/writing from the file… and you want
to make the block “invisible” you’ll have to modify at least two things:

  1. In IRP_MJ_QUERY_INFORMATION(this should be the name) you’ll have to
    make the correct the information buffer for the file: subtract the size
    of the data block.
  2. In IRP_MJ_READ/IRP_MJ_WRITE you should subtract the size of data
    block from the read/write offset.

I still think that you’ll need couple of IRPs to handle before your
filter driver will work without crushing or hangging you computer.:slight_smile:

Best luck,
Hardwired

Kim Byeong-Kyun wrote:

i attached some data in front of original file.
the data has the length, some key data for the origianl file.
and the data size is 4096bytes.
when a certain application reads that file,
my filter driver checks the data i has attached first.
and if the length and key are valid, my filter driver
allows the application to read original data from the file…

i am eager to realize this routine.

i thought like this;

  • when filter driver gets IRP_MJ_CREATE, i make filter driver to try
  • to read the 4096bytes data.

but i cannot read the data. is it right?

please advise me…

You are currently subscribed to ntfsd as: xxxxx@rdslink.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> In case you want to check this(to read from file the data block and make

some checks over it… blah blah) when trying to Open a file, you should
be able to make it from IRP_MJ_CREATE. Use ZwXxxxx functions to read the
data you need from the file.

Don’t forget to check for re-entrance. ZwCreateFile will result in
IRP_MJ_CREATE –> Deadlock and weird bugchecks, hard to debug.

Also don’t forget FastIo QueryOpen (IIRC). If not supported, QueryOpen
results in IRP_MJ_CREATE, so you have to disable QueryOpen, rather simple
task.

To deny IRP_MJ_CREATE, using a status like STATUS_ACCESS_DENIED (again: if I
remember correctly) to result in an Access Denied message for the user.

  1. In IRP_MJ_READ/IRP_MJ_WRITE you should subtract the size of data
    block from the read/write offset.

You should ADD it, but only when it is not your own request. You will have
to remember the FO of your own requests. Also, don’t forget about the FastIo
here.

Hope your inspired, but probably for your purpose there are a lot more
things to do.

4

Perhaps it’s too late but I’d like suggest another way…

You pass every request to underlying FSD. Then in completion routine if file
was created successfuly you can read its contents using IRPs built with
IoBuildSynchronousFsdRequest for example. If header does not match your
criteria, issue IoCancelFileOpen (which is pretty easily implemented on NT4
platform if needed), set Irp->IoStatus.Status = STATUS_ACCESS_DENIED (or any
other appropriate status code), and finally allow IO Manager do the rest but
returning STATUS_SUCCESS.

Good luck!..

----- Original Message -----
From: “Tobias”
To: “File Systems Developers”
Sent: Friday, January 10, 2003 4:23 PM
Subject: [ntfsd] Re: I attached some data in front of original file. and…

> > In case you want to check this(to read from file the data block and make
> > some checks over it… blah blah) when trying to Open a file, you should
> > be able to make it from IRP_MJ_CREATE. Use ZwXxxxx functions to read the
> > data you need from the file.
>
> Don’t forget to check for re-entrance. ZwCreateFile will result in
> IRP_MJ_CREATE –> Deadlock and weird bugchecks, hard to debug.
>
> Also don’t forget FastIo QueryOpen (IIRC). If not supported, QueryOpen
> results in IRP_MJ_CREATE, so you have to disable QueryOpen, rather simple
> task.
>
> To deny IRP_MJ_CREATE, using a status like STATUS_ACCESS_DENIED (again: if
I
> remember correctly) to result in an Access Denied message for the user.
>
> > 2) In IRP_MJ_READ/IRP_MJ_WRITE you should subtract the size of data
> > block from the read/write offset.
>
> You should ADD it, but only when it is not your own request. You will
have
> to remember the FO of your own requests. Also, don’t forget about the
FastIo
> here.
>
> Hope your inspired, but probably for your purpose there are a lot more
> things to do.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>