Thanks for the reply Lyndon,
I suppose much of my confusion has come from what I’ve read that skipped
over the basics. From what I’ve read, or shall I say
from my understanding, there are three ways to prevent re-entry: use
shadow devices, build your own Irp’s, or in XP and above
use IoCreateFileSpecifyDeviceObjectHint.
The IFS along with other things I’ve read seemed at the time to indicate
IoBuildSynchronousFsdRequest when doing an IRP_MJ_READ will
automate the creation complete FO, upon re-reading I see your correct
that the FO will only be valid in a completion routine and
IoCancelFileOpen will have to be called. (in pre-create, the filename is
the only valid object in the FO right?)
Anyhow, if calling IoBuildSynchronousFsdRequest in post create, then the length of the buffer and
startingoffset should be (from the file object):
/Length/: CSHORT Size;
/StartingOffset/: LARGE_INTEGER CurrentByteOffset;
So, the parameter values I am looking for are the ones in the FO’s post create right (those two I listed)?
Anyone have some books to sell that I can afford?
M.
Lyndon J Clarke wrote:
Matt
I wonder if this is even a kernel specific question?
Imagine you are in user mode and you have opened a file with CreateFile. Now
you want to read the file into a buffer. How big must be your buffer
(Length)? Is the answer to this question that you will have to query the
file for its size?
Imagine we change the rules so that when CreateFile returns the file pointer
is at a random location which means you have to seek with
SetFilePointer[Ex]. Where will you seek (Offset)? Is the answer to this
question zero?
I wonder if this is even a windows specific question 
However, since you say, “When I receive an IRP_CREATE, I want to call a
function that uses IoBuildSynchronousFsdRequest to read the file and then
pass or fail the IRP based of what was read out of the file” … there i a
windows kernel specific question here. Do you think to do this in your
pre-operation (aka dispatch)? You can not use the FileObject here to read
the file; the file system has not seen the FileObject and it is not
associated with a file. Do you plan to extract the filename from the
FileObject and then open the file yourself; if so have you considered the
classic recursion in create issues here? Or do you plan to use the
FileObject in post operation (aka completion) and now you are into
IoCancelFileOpen and you will find with a search of the group and a look
around the osronline website a lot of discusssion about this design.
Cheers
Lyndon
“MM” wrote in message news:xxxxx@ntfsd…
>
>
>>Regarding IoBuildSynchronousFsdRequest, I don’t understand two of it’s
>>parameters: Length and StartingOffset…
>>
>>Regarding Length: If I want to read a file into a buffer, how can I set
>>the size of the buffer if I don’t know the size of the file yet?
>>
>>Second, regarding StartingOffset: Where can I fish that value out?
>>
>>When I receive an IRP_CREATE, I want to call a function that uses
>>IoBuildSynchronousFsdRequest to read the file and then pass or fail the
>>IRP based of what was read out of the file. In a pre create scenario like
>>this, the filename in the FO is the only reliable piece of data from my
>>understanding…
>>
>>/Length/
>> Specifies the length, in bytes, of /Buffer/. For devices such as
>> disks, this value must be an integral of 512. This parameter is
>> required for read/write requests, but must be zero for flush and
>> shutdown requests. /StartingOffset/
>> Pointer to the offset on the disk to read/write from/to. This
>> parameter is required for read/write requests, but must be zero for
>> flush and shutdown requests.
>>Sorry for the dumb questions, still new at this ‘kernel mode’ thing. I
>>wish I could afford some books on driver development so I didn’t have to
>>ask moronic questions like this, but since I can’t afford the basic study
>>material (except the IFS, which isn’t really meant for newbies), I hope
>>you’ll excuse me a little…
>>
>>M.
>>
>>
>>
>>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@comcast.net
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>