Issues with Shadow File Objects.

NTFSD
1

Hello All,

After a long fight, finally in second attempt i am able to achieve the SFO in my mini-filter driver.

http://www.osronline.com/cf.cfm?PageURL=showLists.cfm?list=ntfsd

Thanks a lot all of you for guidance and help. Now after its working i am having few question in my mind.

1] The actual file object for which i am creating SFO and keep replacing it in all the call. So what will be the life time for that uninitialized actual file object. What care i should have to take for it?

2] In my mini-filter am handling the below callbacks.
IRP_MJ_CREATE
IRP_MJ_DIRECTORY_CONTROL
IRP_MJ_QUERY_INFORMATION
IRP_MJ_NETWORK_QUERY_OPEN
IRP_MJ_SET_INFORMATION
IRP_MJ_CLOSE
IRP_MJ_WRITE
IRP_MJ_READ
IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION

Do i have to intercept other callbacks also to replace the actual uninitialized file object with SFO ?

3]While creating the SFO i am doing the things as below
ObReferenceObject()
CcInitializeCacheMap()

And in IRP_MJ_CLOSE i am doing the things like
CcUninitializeCacheMap()
ObDereferenceObject()

But some time CcUninitializeCacheMap() gets fails, its not crashing but it giving the FALSE as return value. In this case i am not getting what extra thing i should do?

Please give your comments on it. Thanks in advance.

2

> 1] The actual file object for which i am creating SFO and keep

replacing it in all the call. So what will be the life time for that
uninitialized actual file
object. What care i should have to take for it?

Its up to you. I usually do a FltClose in Cleanup and an
ObDereferenceObject in Close.

Do i have to intercept other callbacks also to replace the actual
uninitialized file object with SFO ?

Only if you don’t want NTFS to crash your machine as soon as it gets
anything else with your FileObject :slight_smile: (so, yes)

But some time CcUninitializeCacheMap() gets fails, its not crashing but
it giving the FALSE as return value. In this case i am not getting what
extra thing i should do?

Your best guid for Cc interaction will be the FAT sources…

3

Thank you rod!!!