Major Function For Mapped Section

NTFSD
1

Hi
What is the mazor function call (IRP_MJ_XXX) for NtCreateSection, NtQuerySection,NtMapViewSection. How Can i intercept these calls wit IRP’s

Regards
Raghwendra

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

2

They dont work with IRPs.

Dan

----- Original Message -----
From: Raghwendra
To: Windows File Systems Devs Interest List
Sent: Tuesday, May 31, 2005 3:07 PM
Subject: [ntfsd] Major Function For Mapped Section

Hi
What is the mazor function call (IRP_MJ_XXX) for NtCreateSection, NtQuerySection,NtMapViewSection. How Can i intercept these calls wit IRP’s

Regards
Raghwendra

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com *********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

3

then how and where could i can hook these call at ring 3. currently i am hooking FAST_IO as well normal IRP calls.
----- Original Message -----
From: Dan Partelly
To: Windows File Systems Devs Interest List
Sent: Tuesday, May 31, 2005 5:40 PM
Subject: Re: [ntfsd] Major Function For Mapped Section

They dont work with IRPs.

Dan

----- Original Message -----
From: Raghwendra
To: Windows File Systems Devs Interest List
Sent: Tuesday, May 31, 2005 3:07 PM
Subject: [ntfsd] Major Function For Mapped Section

Hi
What is the mazor function call (IRP_MJ_XXX) for NtCreateSection, NtQuerySection,NtMapViewSection. How Can i intercept these calls wit IRP’s

Regards
Raghwendra

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com *********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

4

The file system stack only sees when a section gets created. That
notification occurs by one of the following methods:
* FAST_IO AcquireForNtCreateSection - for file systems,
* FsFilter callback AcquireForSectionSynchronization - for file systems
or filters, available in Windows XP and later,
* IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION - for filters via the
Filter Manager, available on the platforms where the Filter Manager is
available.

You do not get any notification for NtMapViewOfSection. Depending what
information is queried, when NtQuerySection is called, you may see an
IRP_MJ_QUERY_INFORMATION_FILE operation if the file system must be
queried to return the information being queried about the section (like
the file name).

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Sent: Tuesday, May 31, 2005 5:25 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Major Function For Mapped Section

then how and where could i can hook these call at ring 3. currently i am
hooking FAST_IO as well normal IRP calls.

----- Original Message -----
From: Dan Partelly mailto:xxxxx
To: Windows File Systems Devs Interest List
mailto:xxxxx
Sent: Tuesday, May 31, 2005 5:40 PM
Subject: Re: [ntfsd] Major Function For Mapped Section

They dont work with IRPs.

Dan

----- Original Message -----
From: Raghwendra mailto:xxxxx
To: Windows File Systems Devs Interest List
mailto:xxxxx
Sent: Tuesday, May 31, 2005 3:07 PM
Subject: [ntfsd] Major Function For Mapped Section

Hi
What is the mazor function call (IRP_MJ_XXX) for
NtCreateSection, NtQuerySection,NtMapViewSection. How Can i intercept
these calls wit IRP’s

Regards
Raghwendra
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com


Disclaimer:
The contents of this E-mail (including the contents of
the enclosure(s) or attachment(s) if any) are privileged and
confidential material of MBT and should not be disclosed to, used by or
copied in any manner by anyone other than the intended addressee(s). In
case you are not the desired addressee, you should delete this message
and/or re-direct it to the sender. The views expressed in this E-mail
message (including the enclosure(s) or attachment(s) if any) are those
of the individual sender, except where the sender expressly, and with
authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is
believed to be free of any virus. However, it is the responsibility of
the recipient to ensure that it is virus free and MBT is not responsible
for any loss or damage arising in any way from its use



—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>