is there a substitute of IoCancelFileOpen() in NT4?

NTFSD
1

The way my Filter driver is working right now is:

I process the CreatFile() on its way up from the FSD. In some cases I need
to cancel the file open in the FSD. In case of Win2k, IoCancelFileOpen()
works fine. But, this call is not supported in NT4. I tried to create my
own irp for cleanup and close and send them down to FSD. The cleanup and
close works fine in the sense that the IoStatus.Status = 0. But, the
filename gets messed up after sending the close. I need the filename in the
fileobject to be right for my processing. Also, I noticed that the filename
remains intact after cleanup, but other fields like FsContext etc get
changed.

I decided to just send a cleanup instead of close. But in this case, I get
a BugCheck at time of driver unload.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4 and explain what really happens to the FileObject
at the time of cleanup and close?

Thanks!

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

The ntfsd archives contain various attempts at reverse-engineering
IoCancelFileOpen() into pseudocode for NT4. (The archives are accessible
at www.osr.com).

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, February 06, 2002 4:19 PM
To: File Systems Developers
Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?

The way my Filter driver is working right now is:

I process the CreatFile() on its way up from the FSD. In some cases I
need
to cancel the file open in the FSD. In case of Win2k,
IoCancelFileOpen()
works fine. But, this call is not supported in NT4. I tried to create
my
own irp for cleanup and close and send them down to FSD. The cleanup
and
close works fine in the sense that the IoStatus.Status = 0. But, the
filename gets messed up after sending the close. I need the filename
in
the
fileobject to be right for my processing. Also, I noticed that the
filename
remains intact after cleanup, but other fields like FsContext etc get
changed.

I decided to just send a cleanup instead of close. But in this case, I
get
a BugCheck at time of driver unload.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4 and explain what really happens to the
FileObject
at the time of cleanup and close?

Thanks!

You are currently subscribed to ntfsd as: xxxxx@secretseal.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

If you step through IoCancelFileOpen you will see that it is doing a
cleanup and a close, and not a whole lot more. I think you need to
re-examine your requirements below that the Filename and the FsContext
are somehow supposed to be untouched through these operations. Perhaps
you need to cache whatever values you need preserved?

=====================
Mark Roddy
Windows XP/2000/NT Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com
xxxxx@hollistech.com
For Windows Device Driver Training: see www.azius.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Nicholas Ryan
Sent: Wednesday, February 06, 2002 4:42 PM
To: File Systems Developers
Subject: [ntfsd] RE: is there a substitute of IoCancelFileOpen() in NT4?

The ntfsd archives contain various attempts at reverse-engineering
IoCancelFileOpen() into pseudocode for NT4. (The archives are accessible
at www.osr.com).

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, February 06, 2002 4:19 PM
To: File Systems Developers
Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?

The way my Filter driver is working right now is:

I process the CreatFile() on its way up from the FSD. In some cases I
need
to cancel the file open in the FSD. In case of Win2k,
IoCancelFileOpen()
works fine. But, this call is not supported in NT4. I tried to create
my
own irp for cleanup and close and send them down to FSD. The cleanup
and
close works fine in the sense that the IoStatus.Status = 0. But, the
filename gets messed up after sending the close. I need the filename
in
the
fileobject to be right for my processing. Also, I noticed that the
filename remains intact after cleanup, but other fields like FsContext

etc get changed.

I decided to just send a cleanup instead of close. But in this case, I
get
a BugCheck at time of driver unload.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4 and explain what really happens to the
FileObject at the time of cleanup and close?

Thanks!

You are currently subscribed to ntfsd as: xxxxx@secretseal.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@hollistech.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Rini,
Unloading filters is dangerous. If you’ve done IoAttachToDeviceStack or any of that family of interfaces, when you close your filter anyone attached above (after) you will be in trouble.

Generally only do it to aid debugging, not for releases.

Andy.
-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: 06 February 2002 16:19
To: File Systems Developers
Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?

The way my Filter driver is working right now is:

I process the CreatFile() on its way up from the FSD. In some cases I need
to cancel the file open in the FSD. In case of Win2k, IoCancelFileOpen()
works fine. But, this call is not supported in NT4. I tried to create my
own irp for cleanup and close and send them down to FSD. The cleanup and
close works fine in the sense that the IoStatus.Status = 0. But, the
filename gets messed up after sending the close. I need the filename in the
fileobject to be right for my processing. Also, I noticed that the filename
remains intact after cleanup, but other fields like FsContext etc get
changed.

I decided to just send a cleanup instead of close. But in this case, I get
a BugCheck at time of driver unload.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4 and explain what really happens to the FileObject
at the time of cleanup and close?

Thanks!

–

Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

Win a ski trip!
http://www.nowcode.com/register.asp?affiliate=1net2phone3a

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Are you trying to use the file object after you have told the FSD to clean it up–meaning last handle to file object closed–and close it–meaning prepare for “IO Manager” to deallocate file object? Of course this won’t work! The FSD has deallocated its FCB (file control block) and CCB (context control block,) pointed to by FsContext and FsContext2. This deallocated context is what the FSD uses to identify and perform operations on the file.

-----Original Message-----
From: Rini Kaushik [mailto:xxxxx@yahoo.com]
Sent: Wednesday, February 06, 2002 10:18 PM
To: File Systems Developers
Subject: [ntfsd] RE: is there a substitute of IoCancelFileOpen() in NT4?

Thanks for the response, Mark. I am sending a cleanup followed by a close. Can I send the same
FileObject down to the next driver? The flags and the vpb reference count etc have all gotten
changed after the close. I tried sending the same irp and fileobject down and the system failed to
find the file. I got status == c00000033.

I need to send create to the FSD after the cancel. What is best way for doing so?

Thanks in advance for help!

Rini
— Mark Roddy wrote:
> If you step through IoCancelFileOpen you will see that it is doing a
> cleanup and a close, and not a whole lot more. I think you need to
> re-examine your requirements below that the Filename and the FsContext
> are somehow supposed to be untouched through these operations. Perhaps
> you need to cache whatever values you need preserved?
>
> =====================
> Mark Roddy
> Windows XP/2000/NT Consulting
> Hollis Technology Solutions 603-321-1032
> www.hollistech.com
> xxxxx@hollistech.com
> For Windows Device Driver Training: see www.azius.com
>
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Nicholas Ryan
> Sent: Wednesday, February 06, 2002 4:42 PM
> To: File Systems Developers
> Subject: [ntfsd] RE: is there a substitute of IoCancelFileOpen() in NT4?
>
>
> The ntfsd archives contain various attempts at reverse-engineering
> IoCancelFileOpen() into pseudocode for NT4. (The archives are accessible
> at www.osr.com).
>
> - Nicholas Ryan (xxxxx@nryan.com)
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
> > xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
> > Sent: Wednesday, February 06, 2002 4:19 PM
> > To: File Systems Developers
> > Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?
> >
> > The way my Filter driver is working right now is:
> >
> > I process the CreatFile() on its way up from the FSD. In some cases I
> need
> > to cancel the file open in the FSD. In case of Win2k,
> IoCancelFileOpen()
> > works fine. But, this call is not supported in NT4. I tried to create
> my
> > own irp for cleanup and close and send them down to FSD. The cleanup
> and
> > close works fine in the sense that the IoStatus.Status = 0. But, the
> > filename gets messed up after sending the close. I need the filename
> in
> > the
> > fileobject to be right for my processing. Also, I noticed that the
> > filename remains intact after cleanup, but other fields like FsContext
>
> > etc get changed.
> >
> > I decided to just send a cleanup instead of close. But in this case, I
> get
> > a BugCheck at time of driver unload.
> >
> > Can someone tell me what’s the most elegant way to emulate
> > IoCancelFileOPen() in NT4 and explain what really happens to the
> > FileObject at the time of cleanup and close?
> >
> > Thanks!
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@secretseal.com To
> > unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yahoo.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

__________________________________________________
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com

—
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

I would say it’s not dangerous but it’s not easy to implement :slight_smile:

Alexey Logachyov
xxxxx@vba.com.by
VirusBlokAda ltd.
http://www.vba.com.by

----- Original Message -----
From: “Andy Champ”
To: “File Systems Developers”
Sent: Thursday, February 07, 2002 11:06 AM
Subject: [ntfsd] RE: is there a substitute of IoCancelFileOpen() in NT4?

> Rini,
> Unloading filters is dangerous. If you’ve done IoAttachToDeviceStack or
any of that family of interfaces, when you close your filter anyone attached
above (after) you will be in trouble.
>
> Generally only do it to aid debugging, not for releases.
>
> Andy.
> -----Original Message-----
> From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
> Sent: 06 February 2002 16:19
> To: File Systems Developers
> Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?
>
>
> The way my Filter driver is working right now is:
>
> I process the CreatFile() on its way up from the FSD. In some cases I need
> to cancel the file open in the FSD. In case of Win2k, IoCancelFileOpen()
> works fine. But, this call is not supported in NT4. I tried to create my
> own irp for cleanup and close and send them down to FSD. The cleanup and
> close works fine in the sense that the IoStatus.Status = 0. But, the
> filename gets messed up after sending the close. I need the filename in
the
> fileobject to be right for my processing. Also, I noticed that the
filename
> remains intact after cleanup, but other fields like FsContext etc get
> changed.
>
> I decided to just send a cleanup instead of close. But in this case, I get
> a BugCheck at time of driver unload.
>
> Can someone tell me what’s the most elegant way to emulate
> IoCancelFileOPen() in NT4 and explain what really happens to the
FileObject
> at the time of cleanup and close?
>
> Thanks!
>
> —
>
> –
>
> _______________________________________________
> Sign-up for your own FREE Personalized E-mail at Mail.com
> http://www.mail.com/?sr=signup
>
> Win a ski trip!
> http://www.nowcode.com/register.asp?affiliate=1net2phone3a
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

The question about messed file name came up many times. The only time you
can rely on FILE_OBJECT->FileName is on its way down to IRP_MJ_CREATE
dispatch routine. Using the file name after IRP_MJ_CLOSE is absolute no-no.
All resources are cleaned up including file name. Store the file name before
you pass file object to lower driver and use it later.

Alexey Logachyov
xxxxx@vba.com.by
VirusBlokAda ltd.
http://www.vba.com.by

----- Original Message -----
From:
To: “File Systems Developers”
Sent: Wednesday, February 06, 2002 4:18 PM
Subject: [ntfsd] is there a substitute of IoCancelFileOpen() in NT4?

> The way my Filter driver is working right now is:
>
> I process the CreatFile() on its way up from the FSD. In some cases I need
> to cancel the file open in the FSD. In case of Win2k, IoCancelFileOpen()
> works fine. But, this call is not supported in NT4. I tried to create my
> own irp for cleanup and close and send them down to FSD. The cleanup and
> close works fine in the sense that the IoStatus.Status = 0. But, the
> filename gets messed up after sending the close. I need the filename in
the
> fileobject to be right for my processing. Also, I noticed that the
filename
> remains intact after cleanup, but other fields like FsContext etc get
> changed.
>
> I decided to just send a cleanup instead of close. But in this case, I get
> a BugCheck at time of driver unload.
>
> Can someone tell me what’s the most elegant way to emulate
> IoCancelFileOPen() in NT4 and explain what really happens to the
FileObject
> at the time of cleanup and close?
>
> Thanks!
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

8

> fileobject to be right for my processing. Also, I noticed that the filename

remains intact after cleanup, but other fields like FsContext etc get
changed.

Save the file name to your own variable before passing CREATE down to the FSD.
The file name is not guaranteed to be valid even on CREATE completion.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4

Assemble CLEANUP and CLOSE IRPs by hand and send them down synchronously.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

9

In addition to the file name, there are other values in the FileObject that
you may need to save and reconstruct after the cleanup/close and before
sending down the create again. Dump the FO contents on the way in and dump
if after the close, save anything that you see gets changed.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Thursday, February 07, 2002 10:51 AM
To: File Systems Developers
Subject: [ntfsd] Re: is there a substitute of IoCancelFileOpen() in NT4?

fileobject to be right for my processing. Also, I noticed that the
filename
remains intact after cleanup, but other fields like FsContext etc get
changed.

Save the file name to your own variable before passing CREATE down to the
FSD.
The file name is not guaranteed to be valid even on CREATE completion.

Can someone tell me what’s the most elegant way to emulate
IoCancelFileOPen() in NT4

Assemble CLEANUP and CLOSE IRPs by hand and send them down synchronously.

Max

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com