IRP_MJ_READ and Directory!

NTFSD
1

Hi,
In my file system filter driver, I received IRP_MJ_READ for a dir. What is
the information (i.e. output buffer) that is returned from this IRP? I would
like to differentiate between IRP_MJ_READ for a dir and for a file, but I
could not find any differences other than the filename itself. My filter
driver is based on the filemon model.
Any information is appreciated…

Thanks,
Sin Lam

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Well, IMHO you should get the file attribute of the file object (see
Filemon for the code for this action) and if this attribute==0x10-
this is a directory, not a file.

TSL> Hi,
TSL> In my file system filter driver, I received IRP_MJ_READ for a dir. What is
TSL> the information (i.e. output buffer) that is returned from this IRP? I would
TSL> like to differentiate between IRP_MJ_READ for a dir and for a file, but I
TSL> could not find any differences other than the filename itself. My filter
TSL> driver is based on the filemon model.
TSL> Any information is appreciated…

TSL> Thanks,
TSL> Sin Lam

TSL> —
TSL> You are currently subscribed to ntfsd as: xxxxx@chat.ru
TSL> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

IRP_MJ_READ on a directory is used internally by the file system driver.
The output buffer is in whatever format the file system stores its
directories on disk. This file system specific format is not exposed to
user-mode. Instead, user-mode reads directories through well defined
interfaces that present the directory entries independent of the file
systems internal structure. A file system filter driver, such as
Filemon, sees IRP’s generated internally by the file system driver which
is why Filemon displays the IRP_MJ_READ of a directory.

-----Original Message-----
From: Tan Sin Lam [mailto:xxxxx@krdl.org.sg]
Sent: Monday, August 27, 2001 5:25 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_READ and Directory!

Hi,
In my file system filter driver, I received IRP_MJ_READ for
a dir. What is
the information (i.e. output buffer) that is returned from
this IRP? I would
like to differentiate between IRP_MJ_READ for a dir and for a
file, but I
could not find any differences other than the filename
itself. My filter
driver is based on the filemon model.
Any information is appreciated…

Thanks,
Sin Lam

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

At least FASTFAT prohibits MJ_READ on directories and fails this.
I think other filesystems do the same.

Max

----- Original Message -----
From: “Tan Sin Lam”
To: “File Systems Developers”
Sent: Monday, August 27, 2001 2:25 PM
Subject: [ntfsd] IRP_MJ_READ and Directory!

> Hi,
> In my file system filter driver, I received IRP_MJ_READ for a dir. What
is
> the information (i.e. output buffer) that is returned from this IRP? I
would
> like to differentiate between IRP_MJ_READ for a dir and for a file, but I
> could not find any differences other than the filename itself. My filter
> driver is based on the filemon model.
> Any information is appreciated…
>
> Thanks,
> Sin Lam
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Max,

FastFat only prohibits IRP_MJ_READ on a user-level file object. FAT will
allow reads from its own file objects. Here’s the beginning of the relevant
code block in the FAT file system:

//
// These two cases correspond to a system read directory file and
// ea file.
//

if (( TypeOfRead == DirectoryFile ) || ( TypeOfRead == EaFile)) {

The whole point here is that the FSDs page their own data structures into
memory - and these are the IRP_MJ_READ operations being observed on a
directory (at least, the one’s that would be ALLOWED by the OS.)

This is the code (again, in fastfat, read.c) that blocks user level read
operations on the directory:

//
// This is the case of a user who openned a directory. No reading is
// allowed.
//

if ( TypeOfRead == UserDirectoryOpen ) {

DebugTrace( 0, Dbg, “CommonRead -> STATUS_INVALID_PARAMETER\n”,
0);

try_return( Status = STATUS_INVALID_PARAMETER );
}

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Monday, August 27, 2001 2:33 PM
To: File Systems Developers
Subject: [ntfsd] Re: IRP_MJ_READ and Directory!

At least FASTFAT prohibits MJ_READ on directories and fails this.
I think other filesystems do the same.

Max

----- Original Message -----
From: “Tan Sin Lam”
To: “File Systems Developers”
Sent: Monday, August 27, 2001 2:25 PM
Subject: [ntfsd] IRP_MJ_READ and Directory!

> Hi,
> In my file system filter driver, I received IRP_MJ_READ for a dir. What
is
> the information (i.e. output buffer) that is returned from this IRP? I
would
> like to differentiate between IRP_MJ_READ for a dir and for a file, but I
> could not find any differences other than the filename itself. My filter
> driver is based on the filemon model.
> Any information is appreciated…
>
> Thanks,
> Sin Lam
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

Thanks Tony for correction, I mentioned exactly this.

----- Original Message -----
From: “Tony Mason”
To: “File Systems Developers”
Sent: Monday, August 27, 2001 10:57 PM
Subject: [ntfsd] Re: IRP_MJ_READ and Directory!

> Max,
>
> FastFat only prohibits IRP_MJ_READ on a user-level file object. FAT will
> allow reads from its own file objects. Here’s the beginning of the
relevant
> code block in the FAT file system:
>
> //
> // These two cases correspond to a system read directory file and
> // ea file.
> //
>
> if (( TypeOfRead == DirectoryFile ) || ( TypeOfRead == EaFile)) {
>
> The whole point here is that the FSDs page their own data structures into
> memory - and these are the IRP_MJ_READ operations being observed on a
> directory (at least, the one’s that would be ALLOWED by the OS.)
>
> This is the code (again, in fastfat, read.c) that blocks user level read
> operations on the directory:
>
> //
> // This is the case of a user who openned a directory. No reading
is
> // allowed.
> //
>
> if ( TypeOfRead == UserDirectoryOpen ) {
>
> DebugTrace( 0, Dbg, “CommonRead ->
STATUS_INVALID_PARAMETER\n”,
> 0);
>
> try_return( Status = STATUS_INVALID_PARAMETER );
> }
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
> Sent: Monday, August 27, 2001 2:33 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: IRP_MJ_READ and Directory!
>
> At least FASTFAT prohibits MJ_READ on directories and fails this.
> I think other filesystems do the same.
>
> Max
>
> ----- Original Message -----
> From: “Tan Sin Lam”
> To: “File Systems Developers”
> Sent: Monday, August 27, 2001 2:25 PM
> Subject: [ntfsd] IRP_MJ_READ and Directory!
>
>
> > Hi,
> > In my file system filter driver, I received IRP_MJ_READ for a dir.
What
> is
> > the information (i.e. output buffer) that is returned from this IRP? I
> would
> > like to differentiate between IRP_MJ_READ for a dir and for a file, but
I
> > could not find any differences other than the filename itself. My filter
> > driver is based on the filemon model.
> > Any information is appreciated…
> >
> > Thanks,
> > Sin Lam
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com