IrpSp->FileObject structure is always Null in Disk Upper Filter Driver

NTDEV
1

Hi,
I am implementing a Upper Class Filter Driver.I need to analyze to the FILE_OBJECT data structure in the filter driver. DDK Document says the Stack Location has a FileObject structure which contains information regarding the File associated with the request.
But, in my filter driver while debugging I observed that this Field is always NULL.

Please suggest me if there is any way to get the File_Object Information in Upper Class Filter Driver.

Thanks,
Narendra.

2

> But, in my filter driver while debugging I observed that this Field is always NULL.

Some driver stacks do not use file objects.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Hi Maxim,

Thanks for your reply and wish you happy new year.

I implemented the Filter driver as a upper Class Filter driver in Storage Stack.
Is there any way to get the FileObject Information below Filesystem Layers?
Does IRP Contains any FileObject Information?

Any help would be appreciated.

Thanks,
Narendra.

4

What are you trying to do with the FileObject information? You
certainly will not get a file object that reflects the file in the file
system you are writing.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com”
wrote in message news:xxxxx@ntdev:

> Hi Maxim,
>
> Thanks for your reply and wish you happy new year.
>
> I implemented the Filter driver as a upper Class Filter driver in Storage Stack.
> Is there any way to get the FileObject Information below Filesystem Layers?
> Does IRP Contains any FileObject Information?
>
> Any help would be appreciated.
>
> Thanks,
> Narendra.

5

Hi,

I am currently studying Filesystem drivers, In DDK it was mentioned that this information is available in the Current Stack Location. whether filesystem will modify this Information? How Filesystem will issue writes for one single file?
How IO Manager will Manage FileObjects?

Thanks,
Narendra.

6

First this line of questions is better on NTFSD since that is the file
system list. A file object represents only an open file for a process,
not the file. File systems combine writes with the cache in most cases
so you are not looking at a write to a file but multiple user requests.

If you want to track file objects you will need a file system filter.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com”
wrote in message news:xxxxx@ntdev:

> Hi,
>
> I am currently studying Filesystem drivers, In DDK it was mentioned that this information is available in the Current Stack Location. whether filesystem will modify this Information? How Filesystem will issue writes for one single file?
> How IO Manager will Manage FileObjects?
>
> Thanks,
> Narendra.

7

> Is there any way to get the FileObject Information below Filesystem Layers?

Impossible.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com