intercepting I/O requests

NTFSD
1

Hello,
Is there a way, and if there is, how can I intercept I/O requests before they are getting to the I/O Manager.
Thanks,
Berty

2

Berty,

You can “catch” SOME requests before they get to the I/O Manager by
intercepting system calls (a rather ugly mechanism that is generally best
avoided) but you cannot intercept paging I/O operations, nor can you capture
I/O operations that are not performed via the system call interface (e.g.
across-the-network SMB requests). In general, this is not a good solution
for most products.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http: http://www.osr.com

Hope to see you at the next OSR file systems class October 7, 2002!

-----Original Message-----
From: Berty Mednel [mailto:bertym@012.net.il]
Sent: Tuesday, April 23, 2002 2:57 PM
To: File Systems Developers
Subject: [ntfsd] intercepting I/O requests

Hello,

Is there a way, and if there is, how can I intercept I/O requests before
they are getting to the I/O Manager.

Thanks,

Berty

—
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%</http:>

3

Are you trying to filter a filesystem driver (for
example, if you want to see opens/closes/reads/writes
for FILES on a volume), or a hardware driver (for
example, if you want to see reads and writes for raw
sectors on a volume partition). Judging from your
previous question, I’m assuming you want to write a
filesystem filter driver. The best place to start is
with the FileSpy filter driver source code provided by
Microsoft in the XP IFS kit. There is also plenty of
documentation included in the IFS kit about filesystem
filtering.

— Berty Mednel wrote:
> Hello,
> Is there a way, and if there is, how can I intercept
> I/O requests before they are getting to the I/O
> Manager.
> Thanks,
> Berty
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@nryan.com
> To unsubscribe send a blank email to
> %%email.unsub%%
>

=====
- Nicholas Ryan

__________________________________________________
Do You Yahoo!?
Yahoo! Games - play chess, backgammon, pool and more
http://games.yahoo.com/

4

By patching NtRead/WriteFile only.
Also note there are paging IO requests, which does not go this way.

Max

----- Original Message -----
From: Berty Mednel
To: File Systems Developers
Sent: Tuesday, April 23, 2002 10:56 PM
Subject: [ntfsd] intercepting I/O requests

Hello,
Is there a way, and if there is, how can I intercept I/O requests before they are getting to the I/O Manager.
Thanks,
Berty

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%