Hi everybody,
I am developing a file system filter driver. I am a beginner but i have managed to get the basics working.The problem is that i want to be able to get the name of the file im reading, for this i need to get the IRP_MJ_CREATE but it is never called and my dispatchcreate function cannot perform. is is something to do with my i/o methods?
if anyone has an answer please help,
sachin
Yahoo! India Matrimony: Find your partner online.
Can you provide some more information please in order to help us help you? I
assume you are seeing some IRP_MJ_CREATE at all? If so then perhaps its to
do with how you determine this is the IRP_MJ_CREATE of interest. If not so
then the basis cant be working! I assume you are also seeing some
IRP_MJ_READ?
“Sachin Chanchani” wrote in message
news:xxxxx@ntfsd…
Hi everybody,
I am developing a file system filter driver. I am a beginner but i have
managed to get the basics working.The problem is that i want to be able to
get the name of the file im reading, for this i need to get the
IRP_MJ_CREATE but it is never called and my dispatchcreate function cannot
perform. is is something to do with my i/o methods?
if anyone has an answer please help,
sachin
Yahoo! India Matrimony: Find your partner online.
thanks for the interest
I see IRP_MJ_READ and can get the contents of the file from the mdladdress. but i cannot see IRP_MJ_CREATE at all. Maybe i need to do something with the irp->iostatus? but IRP_MJ_CREATE is never called.
Lyndon J Clarke wrote:Can you provide some more information please in order to help us help you? I
assume you are seeing some IRP_MJ_CREATE at all? If so then perhaps its to
do with how you determine this is the IRP_MJ_CREATE of interest. If not so
then the basis cant be working! I assume you are also seeing some
IRP_MJ_READ?
“Sachin Chanchani” wrote in message
news:xxxxx@ntfsd…
Hi everybody,
I am developing a file system filter driver. I am a beginner but i have
managed to get the basics working.The problem is that i want to be able to
get the name of the file im reading, for this i need to get the
IRP_MJ_CREATE but it is never called and my dispatchcreate function cannot
perform. is is something to do with my i/o methods?
if anyone has an answer please help,
sachin
Yahoo! India Matrimony: Find your partner online.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.
There must be some IRP_MJ_CREATE.
No one can read from a file without a successful
create request. What file is it ?
Do you load your filter at system boot or e.g.
later manually ? Maybe the create request
came long ago before you start the filtering.
L.
it is any file that is read …say in the explorer or by an application.
I loaded the filter after booting manually. also my filter is loaded in two parts. first i load the driver into the kernel and then i have a userlevel program which attaches the filter to the harddiskvolumeX. so maybe its because of that? if i check the IO_STACK_LOCATON of the next driver in the stack(by using IoGetNextIrpStackLocation) then it gets the IRP_MJ_CREATE…but the filter does not…i wonder why?
thankx,
Sachin
Ladislav Zezula wrote:
There must be some IRP_MJ_CREATE.
No one can read from a file without a successful
create request. What file is it ?
Do you load your filter at system boot or e.g.
later manually ? Maybe the create request
came long ago before you start the filtering.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.
Maybe it is some programming mistake when attaching the
drive … Could you post piece of code which registers IRP
handlers and the code which attaches the driver to a volume ?
L.
If you use DeviceTree to look at where your driver sits in the storage
stack, what do you see as the NEXT driver down? I suspect you are
ending up attached to the raw disk itself, so you only see I/O to the
raw disk, not to the file system.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sachin Chanchani
Sent: Thursday, April 22, 2004 6:03 AM
To: ntfsd redirect
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
it is any file that is read …say in the explorer or by an application.
I loaded the filter after booting manually. also my filter is loaded in
two parts. first i load the driver into the kernel and then i have a
userlevel program which attaches the filter to the harddiskvolumeX. so
maybe its because of that? if i check the IO_STACK_LOCATON of the next
driver in the stack(by using IoGetNextIrpStackLocation) then it gets the
IRP_MJ_CREATE…but the filter does not…i wonder why?
thankx,
Sachin
Ladislav Zezula wrote:
There must be some IRP_MJ_CREATE.
No one can read from a file without a successful
create request. What file is it ?
Do you load your filter at system boot or e.g.
later manually ? Maybe the create request
came long ago before you start the filtering.
L.
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to
xxxxx@lists.osr.com
Yahoo! India Matrimony
http:atrimony/> : Find your partner online
http:matrimony/community.php> . — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed
to ntfsd as: xxxxx@osr.com To unsubscribe send a blank email to
xxxxx@lists.osr.com</http:></http:>
I realised that i had attached my driver to diskperf. now i have disabled it and i get the IRP_MJ_CERATE. but i think you are right may be attached to the raw disk. when i looked using devicetree, my driver did not say what it was attached to. But even though i get IRP_MJ_CREATE, i do not get filename. IrpSp->FileName is a 0 length string. how do i properly attach to the file system? do i need to send my code?
sachin
Tony Mason wrote:
If you use DeviceTree to look at where your driver sits in the storage stack, what do you see as the NEXT driver down? I suspect you are ending up attached to the raw disk itself, so you only see I/O to the raw disk, not to the file system.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Sachin Chanchani
Sent: Thursday, April 22, 2004 6:03 AM
To: ntfsd redirect
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
it is any file that is read …say in the explorer or by an application.
I loaded the filter after booting manually. also my filter is loaded in two parts. first i load the driver into the kernel and then i have a userlevel program which attaches the filter to the harddiskvolumeX. so maybe its because of that? if i check the IO_STACK_LOCATON of the next driver in the stack(by using IoGetNextIrpStackLocation) then it gets the IRP_MJ_CREATE…but the filter does not…i wonder why?
thankx,
Sachin
Ladislav Zezula wrote:
There must be some IRP_MJ_CREATE.
No one can read from a file without a successful
create request. What file is it ?
Do you load your filter at system boot or e.g.
later manually ? Maybe the create request
came long ago before you start the filtering.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online. — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.
Hi
But even though i get IRP_MJ_CREATE, i do not get
filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
how do i properly attach to the file system?
do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
ok ill do the reading,
but anyway here is my code for the adddevice routine.
////////////////////////////////////////////////////////////////////
status = IoCreateDevice(DriverObject,
DEVICE_EXTENSION_SIZE,
NULL,
FILE_DEVICE_DISK_FILE_SYSTEM,
0,
FALSE,
&filterDeviceObject);
// Type of buffering to use for the filter(device)
SET_FLAG(filterDeviceObject->Flags, DO_DIRECT_IO);
// Device Extension(generally a global storage for objs,resources,irps etc
deviceExtension = (PDEVICE_EXTENSION) filterDeviceObject->DeviceExtension;
//Fill a block of mem with zeros…ptr and num of zeros to fill
RtlZeroMemory(deviceExtension, DEVICE_EXTENSION_SIZE);
// Attaches the device object to the highest device object in the satck chain and
// return the previously highest device object, which is passed to
// IoCallDriver when pass IRPs down the device stack
deviceExtension->TargetDeviceObject =
IoAttachDeviceToDeviceStack(filterDeviceObject, PhysicalDeviceObject);
// If target device not found(does not exist)
if (deviceExtension->TargetDeviceObject == NULL) {
IoDeleteDevice(filterDeviceObject);
DebugPrint((1, “TstFilterAddDevice: Unable to attach %X to target %X\n”,
filterDeviceObject, PhysicalDeviceObject));
DbgPrint((“Unable to attach to target”));
return STATUS_NO_SUCH_DEVICE;
}
// Otherwise
// Save the filter device object in the device extension
//(storing device obj)
deviceExtension->DeviceObject = filterDeviceObject;
KeInitializeEvent(&deviceExtension->PagingPathCountEvent,
NotificationEvent, TRUE);
//
// default to DO_POWER_PAGABLE
//
SET_FLAG(filterDeviceObject->Flags, DO_POWER_PAGABLE);
////////////////////////////////////////////////////////////////////////////////////////////////////
and this is the code for attaching the filter it is a userlevel program…
///////////////////////////////////////////////////////////////////////////////////////////////////
BOOLEAN
AddUFilterDriver(
IN HDEVINFO DeviceInfoSet,
IN PSP_DEVINFO_DATA DeviceInfoData,
IN LPTSTR Filter
)
{
size_t length = 0; // character length
size_t size = 0; // buffer size
LPTSTR buffer = GetUpperFilters( DeviceInfoSet, DeviceInfoData );
ASSERT(DeviceInfoData != NULL);
ASSERT(Filter != NULL);
if( buffer == NULL )
{
// if there is no such value in the registry, then there are no upper
// filter drivers loaded, and we can just put one there
// make room for the string, string null terminator, and multisz null
// terminator
length = _tcslen(Filter)+2;
size = length*sizeof(_TCHAR);
buffer = malloc( size );
if( buffer == NULL )
{
printf(“in AddUpperFilterDriver(): unable to allocate memory!\n”);
return (FALSE);
}
// copy the string into the new buffer
_tcscpy(buffer, Filter);
// make the buffer a properly formed multisz
buffer[length-1]=_T(‘\0’);
}
else
{
// add the driver to the driver list
PrependSzToMultiSz(Filter, &buffer);
}
length = MultiSzLength(buffer);
size = length*sizeof(_TCHAR);
// set the new list of filters in place
if( !SetupDiSetDeviceRegistryProperty( DeviceInfoSet,
DeviceInfoData,
SPDRP_UPPERFILTERS,
(PBYTE)buffer,
size )
)
{
printf("in AddUpperFilterDriver(): "
“couldn’t set registry value! error: %u\n”, GetLastError());
free( buffer );
return (FALSE);
}
// no need for buffer anymore
free( buffer );
return (TRUE);
}
//////////////////////////////////////////////////////////////////////////////////////////
any response would help
thanks,
sachin
Ladislav Zezula wrote:
Hi
> But even though i get IRP_MJ_CREATE, i do not get
> filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
> how do i properly attach to the file system?
> do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.
“IrpSp->FileObject->FileName is a 0 length string” means either:
In the second case, FileObject->RelatedFileObject is non-NULL.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Ladislav Zezula
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 9:39 AM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
Hi
But even though i get IRP_MJ_CREATE, i do not get
> filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
how do i properly attach to the file system?
> do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
thankx,
the wierd thing is that in IRP_MJ_PNP i get the fileobject for which IrpSp->FileObject->FileName is not null…but it is called only when i change directory. so i get the names of the directories form dispatchPnP.
-also my FileObject->RelatedFileObject is NULL so that means i have opened DASD volume right?
i tried to attach to the \device\HarddiskVolume3
Filterman shows my driver as an upperfilter driver for HarddiskVolume3.
sachin
“Maxim S. Shatskih” wrote:
“IrpSp->FileObject->FileName is a 0 length string” means either:
- you are getting the DASD volume open
OR
- you’re getting the relative open of some directory - like the “.” pathname.
In the second case, FileObject->RelatedFileObject is non-NULL.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Ladislav Zezula
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 9:39 AM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
Hi
> But even though i get IRP_MJ_CREATE, i do not get
> filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
> how do i properly attach to the file system?
> do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com —
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.
FileObject->FileName makes any sense in CREATE paths only.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Sachin Chanchani
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 4:11 PM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
thankx,
the wierd thing is that in IRP_MJ_PNP i get the fileobject for which IrpSp->FileObject->FileName is not null…but it is called only when i change directory. so i get the names of the directories form dispatchPnP.
-also my FileObject->RelatedFileObject is NULL so that means i have opened DASD volume right?
i tried to attach to the \device\HarddiskVolume3
Filterman shows my driver as an upperfilter driver for HarddiskVolume3.
sachin
“Maxim S. Shatskih” wrote:
“IrpSp->FileObject->FileName is a 0 length string” means either:
- you are getting the DASD volume open
OR
- you’re getting the relative open of some directory - like the “.” pathname.
In the second case, FileObject->RelatedFileObject is non-NULL.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Ladislav Zezula
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 9:39 AM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
Hi
> But even though i get IRP_MJ_CREATE, i do not get
> filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
> how do i properly attach to the file system?
> do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online. — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To unsubscribe send a blank email to xxxxx@lists.osr.com
i am attached to ftdisk. i guess thats the problem. can’t figure out why though…thanks anyway
“Maxim S. Shatskih” wrote: FileObject->FileName makes any sense in CREATE paths only.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Sachin Chanchani
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 4:11 PM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
thankx,
the wierd thing is that in IRP_MJ_PNP i get the fileobject for which IrpSp->FileObject->FileName is not null…but it is called only when i change directory. so i get the names of the directories form dispatchPnP.
-also my FileObject->RelatedFileObject is NULL so that means i have opened DASD volume right?
i tried to attach to the \device\HarddiskVolume3
Filterman shows my driver as an upperfilter driver for HarddiskVolume3.
sachin
“Maxim S. Shatskih” wrote:
“IrpSp->FileObject->FileName is a 0 length string” means either:
- you are getting the DASD volume open
OR
- you’re getting the relative open of some directory - like the “.” pathname.
In the second case, FileObject->RelatedFileObject is non-NULL.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: Ladislav Zezula
To: Windows File Systems Devs Interest List
Sent: Monday, April 26, 2004 9:39 AM
Subject: Re: Re:[ntfsd] IRP_MJ_CREATE problem!
Hi
> But even though i get IRP_MJ_CREATE, i do not get
> filename. IrpSp->FileName is a 0 length string.
This means that you’ve receive a volume open
(at last in FS filter, I don’t know what you are attached to).
> how do i properly attach to the file system?
> do i need to send my code?
No offence, but I think you should study some literature
first before you will start programming. Read the docs about
IoAttachDeviceToDeviceStack, IoRegisterFsRegistrationChange,
IRP_MJ_MOUNT_VOLUME, IRP_MJ_PNP, FastIoDetachDevice
etc.
L.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com —
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online. — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yahoo! India Matrimony: Find your partner online.