I got no answer to Paging IO and Not enough storage available

NTFSD
1

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without changing
the file size, everything goes fine, except, of course, that the file size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

2

If you don’t get an answer it is generally because nobody has insight to
provide. Your situation is very detailed, very specific - but all *I*
can say is that you have a bug in your driver.

I’ve never advocated the approach you are taking, so I don’t have much
insight into why this would happen. I can tell you it has nothing to do
with the fast I/O - it has to do with the fact you are reporting one
size for the file, while the file system is reporting a different size
of the file to the cache manager/memory manager.

Bottom line: you have a bug. You need to identify the source of the
INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
very detailed, your situation doesn’t have an obvious answer (at least
not from the statement of the problem that you’ve given us.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 1:17 AM
To: ntfsd redirect
Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
available

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without
changing
the file size, everything goes fine, except, of course, that the file
size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

I can only add something to Tony’s answer.

I sense that you are debugging your driver using the
trial and error system - “Hey, If I comment out
the one part, it works THIS way, If I keep it uncommented,
it works THAT way”. To find the problem you have,
you have to analyze deeply the requests going to your driver,
think deeply about what the application expect from
the file system, maybe also write a testprogram doing
it the same like the complaining app. And you also must damn
well know the interaction of the file systems with rest of OS.
Otherwise you will be stuck in your development.

Sorry that I’m not telling you anything to help, but from
your description, the bug is not obvious and the problem
is probably very specific to your implementation.

If I were you, I would start FileSpy and compared the output WITH
your driver with the output WITHOUT your driver and would
try to find the difference, which may lead you to the source
of the problem.

L.

4

Thanks, very much, Tony.

Well I really need some guide from you at this list. That’s why I’m
insisting. There’s no other way to get any help (is there?).

I’m intercepting IRP_MJ_QUERY_INFORMATION (and also
IRP_MJ_DIRECTORY_CONTROL). Must I intercept any other function? How get the
cache manager/memory manager the “real” size, and why can’t I intercept it?

I’d really appreciate any help.

Best regards.

Pablo

“Tony Mason” escribió en el mensaje news:xxxxx@ntfsd…
If you don’t get an answer it is generally because nobody has insight to
provide. Your situation is very detailed, very specific - but all I
can say is that you have a bug in your driver.

I’ve never advocated the approach you are taking, so I don’t have much
insight into why this would happen. I can tell you it has nothing to do
with the fast I/O - it has to do with the fact you are reporting one
size for the file, while the file system is reporting a different size
of the file to the cache manager/memory manager.

Bottom line: you have a bug. You need to identify the source of the
INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
very detailed, your situation doesn’t have an obvious answer (at least
not from the statement of the problem that you’ve given us.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 1:17 AM
To: ntfsd redirect
Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
available

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without
changing
the file size, everything goes fine, except, of course, that the file
size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Thanks, very much, for your answer, Ladislav.

I’ll try it.

Best regards.

Pablo

“Ladislav Zezula” escribió en el mensaje
news:xxxxx@ntfsd…
> I can only add something to Tony’s answer.
>
> I sense that you are debugging your driver using the
> trial and error system - “Hey, If I comment out
> the one part, it works THIS way, If I keep it uncommented,
> it works THAT way”. To find the problem you have,
> you have to analyze deeply the requests going to your driver,
> think deeply about what the application expect from
> the file system, maybe also write a testprogram doing
> it the same like the complaining app. And you also must damn
> well know the interaction of the file systems with rest of OS.
> Otherwise you will be stuck in your development.
>
> Sorry that I’m not telling you anything to help, but from
> your description, the bug is not obvious and the problem
> is probably very specific to your implementation.
>
> If I were you, I would start FileSpy and compared the output WITH
> your driver with the output WITHOUT your driver and would
> try to find the difference, which may lead you to the source
> of the problem.
>
> L.
>
>

6

The problem, as I’ve noted before, is that file size information is reported by the file system to the VM system using a direct function call. While people have reported successfully “hiding” headers within a file, I’ve never been able to convince myself there aren’t lurking failure scenarios (i.e., when you mix cached and non-cached I/O, which is always problematic, for instance). In addition, the problem we’ve been working to solve with our own toolkit is to allow compression on top of the existing file system - a problem that cannot be solved by simply changing the file size.

Thus, I have no additional insight to share but other’s might.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 11:10 AM
To: ntfsd redirect
Subject: Re:[ntfsd] I got no answer to Paging IO and Not enough storage available

Thanks, very much, Tony.

Well I really need some guide from you at this list. That’s why I’m
insisting. There’s no other way to get any help (is there?).

I’m intercepting IRP_MJ_QUERY_INFORMATION (and also
IRP_MJ_DIRECTORY_CONTROL). Must I intercept any other function? How get the
cache manager/memory manager the “real” size, and why can’t I intercept it?

I’d really appreciate any help.

Best regards.

Pablo

“Tony Mason” escribi? en el mensaje news:xxxxx@ntfsd…
If you don’t get an answer it is generally because nobody has insight to
provide. Your situation is very detailed, very specific - but all I
can say is that you have a bug in your driver.

I’ve never advocated the approach you are taking, so I don’t have much
insight into why this would happen. I can tell you it has nothing to do
with the fast I/O - it has to do with the fact you are reporting one
size for the file, while the file system is reporting a different size
of the file to the cache manager/memory manager.

Bottom line: you have a bug. You need to identify the source of the
INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
very detailed, your situation doesn’t have an obvious answer (at least
not from the statement of the problem that you’ve given us.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 1:17 AM
To: ntfsd redirect
Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
available

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without
changing
the file size, everything goes fine, except, of course, that the file
size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Tony,

Thanks, very much, for your answer. I really appreciate it.

Best regards.

Pablo Frank

“Tony Mason” escribió en el mensaje news:xxxxx@ntfsd…
The problem, as I’ve noted before, is that file size information is reported
by the file system to the VM system using a direct function call. While
people have reported successfully “hiding” headers within a file, I’ve never
been able to convince myself there aren’t lurking failure scenarios (i.e.,
when you mix cached and non-cached I/O, which is always problematic, for
instance). In addition, the problem we’ve been working to solve with our
own toolkit is to allow compression on top of the existing file system - a
problem that cannot be solved by simply changing the file size.

Thus, I have no additional insight to share but other’s might.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 11:10 AM
To: ntfsd redirect
Subject: Re:[ntfsd] I got no answer to Paging IO and Not enough storage
available

Thanks, very much, Tony.

Well I really need some guide from you at this list. That’s why I’m
insisting. There’s no other way to get any help (is there?).

I’m intercepting IRP_MJ_QUERY_INFORMATION (and also
IRP_MJ_DIRECTORY_CONTROL). Must I intercept any other function? How get the
cache manager/memory manager the “real” size, and why can’t I intercept it?

I’d really appreciate any help.

Best regards.

Pablo

“Tony Mason” escribió en el mensaje news:xxxxx@ntfsd…
If you don’t get an answer it is generally because nobody has insight to
provide. Your situation is very detailed, very specific - but all I
can say is that you have a bug in your driver.

I’ve never advocated the approach you are taking, so I don’t have much
insight into why this would happen. I can tell you it has nothing to do
with the fast I/O - it has to do with the fact you are reporting one
size for the file, while the file system is reporting a different size
of the file to the cache manager/memory manager.

Bottom line: you have a bug. You need to identify the source of the
INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
very detailed, your situation doesn’t have an obvious answer (at least
not from the statement of the problem that you’ve given us.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 1:17 AM
To: ntfsd redirect
Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
available

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without
changing
the file size, everything goes fine, except, of course, that the file
size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

Just a last (but very important) question:

May I assume that using the VM system a direct function call, that call is
not trapable at all by a FSFD?

or, on the contrary, is there a way to trap it? or some way to indicate to
the VMS the new size?

Best regards.

Pablo

“Tony Mason” escribió en el mensaje news:xxxxx@ntfsd…
The problem, as I’ve noted before, is that file size information is reported
by the file system to the VM system using a direct function call. While
people have reported successfully “hiding” headers within a file, I’ve never
been able to convince myself there aren’t lurking failure scenarios (i.e.,
when you mix cached and non-cached I/O, which is always problematic, for
instance). In addition, the problem we’ve been working to solve with our
own toolkit is to allow compression on top of the existing file system - a
problem that cannot be solved by simply changing the file size.

Thus, I have no additional insight to share but other’s might.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 11:10 AM
To: ntfsd redirect
Subject: Re:[ntfsd] I got no answer to Paging IO and Not enough storage
available

Thanks, very much, Tony.

Well I really need some guide from you at this list. That’s why I’m
insisting. There’s no other way to get any help (is there?).

I’m intercepting IRP_MJ_QUERY_INFORMATION (and also
IRP_MJ_DIRECTORY_CONTROL). Must I intercept any other function? How get the
cache manager/memory manager the “real” size, and why can’t I intercept it?

I’d really appreciate any help.

Best regards.

Pablo

“Tony Mason” escribió en el mensaje news:xxxxx@ntfsd…
If you don’t get an answer it is generally because nobody has insight to
provide. Your situation is very detailed, very specific - but all I
can say is that you have a bug in your driver.

I’ve never advocated the approach you are taking, so I don’t have much
insight into why this would happen. I can tell you it has nothing to do
with the fast I/O - it has to do with the fact you are reporting one
size for the file, while the file system is reporting a different size
of the file to the cache manager/memory manager.

Bottom line: you have a bug. You need to identify the source of the
INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
very detailed, your situation doesn’t have an obvious answer (at least
not from the statement of the problem that you’ve given us.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
Sent: Tuesday, October 18, 2005 1:17 AM
To: ntfsd redirect
Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
available

Hi,

I sent this question before and I got no answer. I think it’s a very
specific question. I’ll send it again here:

I’m having a problem in the decryption part of a FSD. I’m getting a “not
enough storage is available to process this command” message in Notepad.

I return FALSE from the FastIoQueryStandardInfo function (the encrypted
files have a header) and provide the modified (smaller) size in the
completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
FALSE from the FastIoRead function and I provide the NOCACHE dispatch
function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
dispatch function is actually called for NOCACHE and PAGING_IO reads.

If I return TRUE from the FastIoQueryStandardInfo function without
changing
the file size, everything goes fine, except, of course, that the file
size
is wrong!

Can you give me any suggestion.

Best regards.
Pablo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

I have met the similar problem several years ago. I can remember there is an
extra thing to do: update CurrentByteOffset of fileobject at completion of
reading/writing.

–
Polo G.Z
EAZ Solution,Inc.
Http://www.eazsolution.com
->Make your life easier!

----- Original Message -----
From: “Pablo Frank”
Newsgroups: ntfsd
To:
Sent: Tuesday, October 18, 2005 11:09 PM
Subject: Re: I got no answer to Paging IO and Not enough storage available

> Thanks, very much, Tony.
>
> Well I really need some guide from you at this list. That’s why I’m
> insisting. There’s no other way to get any help (is there?).
>
> I’m intercepting IRP_MJ_QUERY_INFORMATION (and also
> IRP_MJ_DIRECTORY_CONTROL). Must I intercept any other function? How get
> the
> cache manager/memory manager the “real” size, and why can’t I intercept
> it?
>
> I’d really appreciate any help.
>
> Best regards.
>
> Pablo
>
>
>
>
> “Tony Mason” escribi en el mensaje news:xxxxx@ntfsd…
> If you don’t get an answer it is generally because nobody has insight to
> provide. Your situation is very detailed, very specific - but all I
> can say is that you have a bug in your driver.
>
> I’ve never advocated the approach you are taking, so I don’t have much
> insight into why this would happen. I can tell you it has nothing to do
> with the fast I/O - it has to do with the fact you are reporting one
> size for the file, while the file system is reporting a different size
> of the file to the cache manager/memory manager.
>
> Bottom line: you have a bug. You need to identify the source of the
> INSUFFICIENT_RESOURCES and then figure out why. Unfortunately, while
> very detailed, your situation doesn’t have an obvious answer (at least
> not from the statement of the problem that you’ve given us.)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> Looking forward to seeing you at the next OSR File Systems class in Los
> Angeles, CA October 24-27, 2005.
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Pablo Frank
> Sent: Tuesday, October 18, 2005 1:17 AM
> To: ntfsd redirect
> Subject: [ntfsd] I got no answer to Paging IO and Not enough storage
> available
>
> Hi,
>
> I sent this question before and I got no answer. I think it’s a very
> specific question. I’ll send it again here:
>
> I’m having a problem in the decryption part of a FSD. I’m getting a “not
> enough storage is available to process this command” message in Notepad.
>
> I return FALSE from the FastIoQueryStandardInfo function (the encrypted
> files have a header) and provide the modified (smaller) size in the
> completion routine of IRP_QUERY_STANDARD_INFORMATION. Of course I return
> FALSE from the FastIoRead function and I provide the NOCACHE dispatch
> function for IRP_MJ_READ. I also flushed the cache so the IRP_MJ_READ
> dispatch function is actually called for NOCACHE and PAGING_IO reads.
>
> If I return TRUE from the FastIoQueryStandardInfo function without
> changing
> the file size, everything goes fine, except, of course, that the file
> size
> is wrong!
>
> Can you give me any suggestion.
>
> Best regards.
> Pablo
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

10

Pablo,

I assume you’re trapping the fast I/O calls (standard info calls, fast I/O
query open)?

Regards, Dejan.

Pablo Frank wrote:

Just a last (but very important) question:

May I assume that using the VM system a direct function call, that call is
not trapable at all by a FSFD?

or, on the contrary, is there a way to trap it? or some way to indicate to
the VMS the new size?

–
Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

11

Hi, Dejan,

I’m trapping the FastIoRead and FastIoStandardInfo functions. As a matter of
fact, my driver return FALSE on this functions if it’s my file, so the IRP
functions are called (what in fact occurs).

Concerning FastIoQueryOpen, I just added a debug message, but I never see my
file going through that function.

I hope this is what you asked.

Best regards.

Pablo

“Dejan Maksimovic” escribió en el mensaje
news:xxxxx@ntfsd…
>
> Pablo,
>
> I assume you’re trapping the fast I/O calls (standard info calls,
fast I/O
> query open)?
>
> Regards, Dejan.
>
> Pablo Frank wrote:
>
> > Just a last (but very important) question:
> >
> > May I assume that using the VM system a direct function call, that call
is
> > not trapable at all by a FSFD?
> >
> > or, on the contrary, is there a way to trap it? or some way to indicate
to
> > the VMS the new size?
>
> –
> Kind regards, Dejan M.
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32
developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>

12

Yes, that’s what I meant. How about the query directory calls? Are you checking
during directory listing if the file is your file? Microsoft Word definitely relies
on this.

Pablo Frank wrote:

Hi, Dejan,

I’m trapping the FastIoRead and FastIoStandardInfo functions. As a matter of fact,
my driver return FALSE on this functions if it’s my file, so the IRP functions are
called (what in fact occurs).

Concerning FastIoQueryOpen, I just added a debug message, but I never see my file
going through that function.

–
Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

13

Yes. I’m trapping IRP_MJ_QUERY_INFORMATION for my file and
IRP_MJ_DIRECTORY_CONTROL. for the directory. Must I trapp anything else?

Thanks a lot for taking the time to help on this.

Best regards.

Pablo

“Dejan Maksimovic” escribió en el mensaje
news:xxxxx@ntfsd…
>
> Yes, that’s what I meant. How about the query directory calls? Are you
checking
> during directory listing if the file is your file? Microsoft Word
definitely relies
> on this.
>
> Pablo Frank wrote:
>
> > Hi, Dejan,
> >
> > I’m trapping the FastIoRead and FastIoStandardInfo functions. As a
matter of fact,
> > my driver return FALSE on this functions if it’s my file, so the IRP
functions are
> > called (what in fact occurs).
> >
> > Concerning FastIoQueryOpen, I just added a debug message, but I never
see my file
> > going through that function.
>
> –
> Kind regards, Dejan M.
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32
developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>

14

FastIoQueryOpen is used in syscalls like NtQueryAttributesFile, which
accept the pathname (not handle) and do something with a file without creating
user visible handles.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Pablo Frank”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, October 25, 2005 1:54 AM
Subject: Re:[ntfsd] I got no answer to Paging IO and Not enough storage
available

> Hi, Dejan,
>
> I’m trapping the FastIoRead and FastIoStandardInfo functions. As a matter of
> fact, my driver return FALSE on this functions if it’s my file, so the IRP
> functions are called (what in fact occurs).
>
> Concerning FastIoQueryOpen, I just added a debug message, but I never see my
> file going through that function.
>
> I hope this is what you asked.
>
> Best regards.
>
> Pablo
>
>
> “Dejan Maksimovic” escribió en el mensaje
> news:xxxxx@ntfsd…
> >
> > Pablo,
> >
> > I assume you’re trapping the fast I/O calls (standard info calls,
> fast I/O
> > query open)?
> >
> > Regards, Dejan.
> >
> > Pablo Frank wrote:
> >
> > > Just a last (but very important) question:
> > >
> > > May I assume that using the VM system a direct function call, that call
> is
> > > not trapable at all by a FSFD?
> > >
> > > or, on the contrary, is there a way to trap it? or some way to indicate
> to
> > > the VMS the new size?
> >
> > –
> > Kind regards, Dejan M.
> > http://www.alfasp.com E-mail: xxxxx@alfasp.com
> > Alfa Transparent File Encryptor - Transparent file encryption services.
> > Alfa File Protector - File protection and hiding library for Win32
> developers.
> > Alfa File Monitor - File monitoring library for Win32 developers.
> >
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

15

Thanks, very much.

Anyway, I never see a call to FastIoQueryOpen in my driver.

Best regards.

Pablo

“Maxim S. Shatskih” escribio en el mensaje
news:xxxxx@ntfsd…
> FastIoQueryOpen is used in syscalls like NtQueryAttributesFile, which
> accept the pathname (not handle) and do something with a file without
creating
> user visible handles.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Pablo Frank”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Tuesday, October 25, 2005 1:54 AM
> Subject: Re:[ntfsd] I got no answer to Paging IO and Not enough storage
> available
>
>
> > Hi, Dejan,
> >
> > I’m trapping the FastIoRead and FastIoStandardInfo functions. As a
matter of
> > fact, my driver return FALSE on this functions if it’s my file, so the
IRP
> > functions are called (what in fact occurs).
> >
> > Concerning FastIoQueryOpen, I just added a debug message, but I never
see my
> > file going through that function.
> >
> > I hope this is what you asked.
> >
> > Best regards.
> >
> > Pablo
> >
> >
> > “Dejan Maksimovic” escribió en el mensaje
> > news:xxxxx@ntfsd…
> > >
> > > Pablo,
> > >
> > > I assume you’re trapping the fast I/O calls (standard info
calls,
> > fast I/O
> > > query open)?
> > >
> > > Regards, Dejan.
> > >
> > > Pablo Frank wrote:
> > >
> > > > Just a last (but very important) question:
> > > >
> > > > May I assume that using the VM system a direct function call, that
call
> > is
> > > > not trapable at all by a FSFD?
> > > >
> > > > or, on the contrary, is there a way to trap it? or some way to
indicate
> > to
> > > > the VMS the new size?
> > >
> > > –
> > > Kind regards, Dejan M.
> > > http://www.alfasp.com E-mail: xxxxx@alfasp.com
> > > Alfa Transparent File Encryptor - Transparent file encryption
services.
> > > Alfa File Protector - File protection and hiding library for Win32
> > developers.
> > > Alfa File Monitor - File monitoring library for Win32 developers.
> > >
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>