Is IRP_MJ_SET_INFO always seen during a save

NTFSD
1

Hello Gurus,

“I am new to driver development”
I already have the experience of working at a car service / car wash.
While the job was more fun than any kind of programming (including
whatever I have seen of filters) money sucked there.
So I don’t want to join “I have a filter that doesn’t work” club, so I
chose to write a passive filter for my application.

The application is based on the following assumption.

Whenever a file is saved by any application, say a .doc by MSword or
.htm by Visual Studio or wordpad, there will always be atleast one
IRP_MJ_SET_INFO request for this file.

Please note:
Multiple requests can come from a single save. Requests can come from
operations other than save. (delete, rename) That’s ok.

I am getting the file name during IRP_MJ_SET_INFO in the usual way of
creating a stream context during IRP_MJ_CREATE.

So far, experiments with FileMon show that the assumption is correct.
Please let me know if there can be cases when this goes wrong.

Thank you very much in advance for all answers.

-V.

2

No, this isn’t required. If you want you can build an application to
explicitly demonstrate this but I distinctly remember seeing that “edit”
does not do a set information as part of saving its files.

Or try Ladislav’s excellent FileTest utility (you can download from
www.osronline.com) to do this as well. If you can do it in Ladislav’s
test application, you can see it from an application program.

The risk that you (and anyone in this space) has is relying only upon
Win32 to test your filter. That’s a dangerous proposition - here at OSR
we actually have a home-grown scripting tool that is written against the
native API and that we use to explicitly test for a range of conditions
that has grown over the years just by adding scenarios we’ve stumbled
across.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vijaya Nivarthi
Sent: Monday, September 11, 2006 7:07 AM
To: ntfsd redirect
Subject: [ntfsd] Is IRP_MJ_SET_INFO always seen during a save

Hello Gurus,

“I am new to driver development”
I already have the experience of working at a car service / car wash.
While the job was more fun than any kind of programming (including
whatever I have seen of filters) money sucked there.
So I don’t want to join “I have a filter that doesn’t work” club, so I
chose to write a passive filter for my application.

The application is based on the following assumption.

Whenever a file is saved by any application, say a .doc by MSword or
.htm by Visual Studio or wordpad, there will always be atleast one
IRP_MJ_SET_INFO request for this file.

Please note:
Multiple requests can come from a single save. Requests can come from
operations other than save. (delete, rename) That’s ok.

I am getting the file name during IRP_MJ_SET_INFO in the usual way of
creating a stream context during IRP_MJ_CREATE.

So far, experiments with FileMon show that the assumption is correct.
Please let me know if there can be cases when this goes wrong.

Thank you very much in advance for all answers.

-V.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

You assume, that for all possible applications, file save (ah, for all
possible applications which have concept of file save, ok) the act of save
will contain at least one IRP_MJ_SET_INFORMATION for some information class.
This has to be a false assumption since it is trivial for everyone to
imagine an application which does not so behave.

The other thing is you seem to assume that you can always get filename in
IRP_MJ_SET_INFORMATION. This ought to be a false assumption since
IRP_MJ_SET_INFORMATION ought to be able arise in a recursive situation where
file system resource are held already and query of file system for file name
can lead to deadlock - at least see filespy in IFS KIT / WDK and docs for
IoGetToplevelIrp for more information.

Well, good luck, you are going to need an awful lot of that, I think.

“Vijaya Nivarthi” wrote in message
news:xxxxx@ntfsd…
Hello Gurus,

“I am new to driver development”
I already have the experience of working at a car service / car wash.
While the job was more fun than any kind of programming (including
whatever I have seen of filters) money sucked there.
So I don’t want to join “I have a filter that doesn’t work” club, so I
chose to write a passive filter for my application.

The application is based on the following assumption.

Whenever a file is saved by any application, say a .doc by MSword or
.htm by Visual Studio or wordpad, there will always be atleast one
IRP_MJ_SET_INFO request for this file.

Please note:
Multiple requests can come from a single save. Requests can come from
operations other than save. (delete, rename) That’s ok.

I am getting the file name during IRP_MJ_SET_INFO in the usual way of
creating a stream context during IRP_MJ_CREATE.

So far, experiments with FileMon show that the assumption is correct.
Please let me know if there can be cases when this goes wrong.

Thank you very much in advance for all answers.

-V.

4

Actually this kind of experimenting done without some
theory learnt leads to nowhere. Starting with trying to analyze
Word save process is like trying to assemble an aircraft
if you just learnt to use screwdriver.

You better buy the FS internals book from OSR first
and read a bit about how FSs work. Then, you can start
observe file system requests from a testprogram made by you
(like CreateFile+WriteFile+CloseFile).

When you are able to fully understand the operations going on,
you can use WDK samples to make your own filters.

Anyway, don’t expect a working filter soon, there’s much
things to explore for you. Good luck in doomed FS development :slight_smile:

L.