IRP_MJ_CREATE

hi all,

could it be possible that IRP_MJ_CREATE is created through routines
that aren’t ZwCreateFile/ZwOpenFile ?

thanks,


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Sure,
Many file system filter implementors ‘roll their own’ IRP_MJ_CREATE
irps to get around the complications caused by reentering the device stack
from the top when calling ZwCreateFile.

-----Original Message-----
From: xxxxx@exent.com [mailto:xxxxx@exent.com]
Sent: Wednesday, March 28, 2001 7:24 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_CREATE

hi all,

could it be possible that IRP_MJ_CREATE is created through routines
that aren’t ZwCreateFile/ZwOpenFile ?

thanks,


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> could it be possible that IRP_MJ_CREATE is created through routines

that aren’t ZwCreateFile/ZwOpenFile ?

This is extremely hard, unsupported by MS and thus not so recommended for
developers. MJ_CREATE IRPs are normally created in IopParseDevice only -
which is the engine under ZwCreateFile.
If you really need this - IIRC Joel Smith knows how to do this.

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

hi,
thanks for your quick response.
i’m not sure that i was fully understood.
i hook nt system services createFile/openFile, my driver is placed
above the io manager. i think that some MJ_CREATE irp’s are
generated without passing through my hook routines. i was wondering
if it’s possible.
thanks,

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Smith, Joel
Sent: Wednesday, March 28, 2001 8:48 PM
To: File Systems Developers
Subject: [ntfsd] RE: IRP_MJ_CREATE

Sure,
Many file system filter implementors ‘roll their own’ IRP_MJ_CREATE
irps to get around the complications caused by reentering the device stack
from the top when calling ZwCreateFile.

-----Original Message-----
From: xxxxx@exent.com [mailto:xxxxx@exent.com mailto:xxxxx]

Sent: Wednesday, March 28, 2001 7:24 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_CREATE

hi all,

could it be possible that IRP_MJ_CREATE is created through routines
that aren’t ZwCreateFile/ZwOpenFile ?

thanks,


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exent.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx>

Yes, what your probably observing is IRP_MJ_CLEANUPs without a
corresponding create, right? These ARE common and come from the file system
conjuring up file objects for its own nefarious purposes (to establish
caching, for example). The file systems does this with routines called
IoCreateStreamFileObject and IoCreateStreamFileObjectLite. For the latter
function, you won’t see the cleanup.

-Joel

-----Original Message-----
From: Amir kedan [mailto:xxxxx@exent.com]
Sent: Thursday, March 29, 2001 2:49 AM
To: File Systems Developers
Subject: [ntfsd] RE: IRP_MJ_CREATE

hi,
thanks for your quick response.
i’m not sure that i was fully understood.
i hook nt system services createFile/openFile, my driver is placed
above the io manager. i think that some MJ_CREATE irp’s are
generated without passing through my hook routines. i was wondering
if it’s possible.
thanks,

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Smith, Joel
Sent: Wednesday, March 28, 2001 8:48 PM
To: File Systems Developers
Subject: [ntfsd] RE: IRP_MJ_CREATE

Sure,
Many file system filter implementors ‘roll their own’ IRP_MJ_CREATE
irps to get around the complications caused by reentering the device stack
from the top when calling ZwCreateFile.

-----Original Message-----
From: xxxxx@exent.com [mailto:xxxxx@exent.com mailto:xxxxx]

Sent: Wednesday, March 28, 2001 7:24 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_CREATE

hi all,

could it be possible that IRP_MJ_CREATE is created through routines
that aren’t ZwCreateFile/ZwOpenFile ?

thanks,


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exent.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx>

RE: [ntfsd] IRP_MJ_CREATE>i hook nt system services createFile/openFile, my driver is placed

above the io manager. i think that some MJ_CREATE irp’s are

Ur Driver will be placed after I./O Manager. I/O manager will create IRP’s and then it sends to below drivers to perform the operation.

Regards,
Satish K.S

----- Original Message -----
From: Amir kedan
To: File Systems Developers
Sent: Thursday, March 29, 2001 1:19 PM
Subject: [ntfsd] RE: IRP_MJ_CREATE

hi,
thanks for your quick response.
i’m not sure that i was fully understood.
i hook nt system services createFile/openFile, my driver is placed
above the io manager. i think that some MJ_CREATE irp’s are
generated without passing through my hook routines. i was wondering
if it’s possible.
thanks,
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]On Behalf Of Smith, Joel
Sent: Wednesday, March 28, 2001 8:48 PM
To: File Systems Developers
Subject: [ntfsd] RE: IRP_MJ_CREATE

Sure,
Many file system filter implementors ‘roll their own’ IRP_MJ_CREATE irps to get around the complications caused by reentering the device stack from the top when calling ZwCreateFile.

-----Original Message-----
From: xxxxx@exent.com [mailto:xxxxx@exent.com]
Sent: Wednesday, March 28, 2001 7:24 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_CREATE

hi all,

could it be possible that IRP_MJ_CREATE is created through routines
that aren’t ZwCreateFile/ZwOpenFile ?

thanks,


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exent.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@aalayance.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com