I writed a file systems filter driver based on the DDK 3790 simple
code : sfilter.
after load the driver,the software “FileMon” find out:
595 12:28:54.765 explorer.exe:1720 IRP_MJ_CREATE E:\ SUCCESS
Options: Open Directory Access: All
596 12:28:54.765 explorer.exe:1720 IRP_MJ_QUERY_INFORMATION E:\
INVALID PARAMETER FileNameInformation
every time,the explorer first IRP_MJ_CREATE and returned success ,
then IRP_MJ_QUERY_INFORMATION but returned INVALID PARAMETER.
i test the sfilter.sys,it work well. and i only modified the sfcreate.
why my driver work not well?
i write a dispatch routine for IRP_MJ_QUERY_INFORMATION and trace
into it find :
NTSTATUS PadLockFilterQueryInfomation( IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp )
{
//
// PadLockFilterilter doesn’t allow handles to its control device
object to be created,
// therefore, no other operation should be able to come through.
//
//ASSERT( !IS_MY_CONTROL_DEVICE_OBJECT( DeviceObject ) );
NTSTATUS status = STATUS_SUCCESS;
PIO_STACK_LOCATION irpStack;
irpStack = IoGetCurrentIrpStackLocation( Irp );
if ( IS_MY_CONTROL_DEVICE_OBJECT( DeviceObject ) )
{
//
// A request is being made on our control device object
//
DBGS(" IS_MY_CONTROL_DEVICE_OBJECT ");
Irp->IoStatus.Information = 0;
status = STATUS_INVALID_DEVICE_REQUEST;
//PadLockFilterDeviceIoControl( DeviceObject,Irp);
Irp->IoStatus.Status = status;
//
// We have completed all processing for this IRP, so tell the
// I/O Manager. This IRP will not be passed any further down
// the stack since no drivers below FileSpy care about this
// I/O operation that was directed to FileSpy.
//
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return status;
}
ASSERT( IS_MY_DEVICE_OBJECT( DeviceObject ) );
IoSkipCurrentIrpStackLocation( Irp );
//
// Call the appropriate file system driver with the request.
//
status = IoCallDriver( ( ( PPADLOCKFILTER_DEVICE_EXTENSION
)DeviceObject->DeviceExtension )->AttachedToDeviceObject, Irp );
return status;
}
**********************************************
IoCallDriver retuned the code INVALID_PARAMETER.
help me!thanks a lot.