minifilter CREATE Redirect to different volume

NTFSD
1

i am trying to redirect a CREATE file call to a different volume.

In the IRP_MJ_CREATE minifilter PreCreate callback,
i do this

Data->Iopb->TargetInstance=pShadowInstance;
FltSetCallbackDataDirty(Data);

return FLT_PREOP_SUCCESS_NO_CALLBACK;
I get a blue screen pretty instantly.

Q1.
Do future IRPs for this file pointer also have to be
redirected to the proper volume, or is this done automatically?

Q2.
Do i need a PostCreate callback that will restore the
original instance pointer ?

Thanks in advance

BTW, i already have working code to do this via STATUS_REPARSE
but i presume the above code is a cleaner way of doing it.

Thanks
Y

2

hi, I am very glad to read your post. I want to redirect a open file request, for example, when open file “\testdir\a.txt”, instead open file “\testdir\b.txt”. In minifilter precreate function, I wrote the following code. Would yo like to help me correct my error? thanx a lot!

here is my code:

LT_PREOP_CALLBACK_STATUS
FsPreCreate (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
NTSTATUS status = FLT_PREOP_SUCCESS_WITH_CALLBACK;
UNICODE_STRING targetFile;
PWCHAR pBuffer = NULL;
ULONG len, maxlen;

//judge if open file “\testdir\a.txt”, if it is, then…
if (IsCheckedFile(&(Data->Iopb->TargetFileObject->FileName)))
{
RtlInitUnicodeString(&targetFile, L"\testdir\b.txt");
len = targetFile.Length;
maxlen = targetFile.MaximumLength;

pBuffer = (PWCHAR) ExAllocatePool(NonPagedPool, maxlen);
if(!pBuffer)
{
return status;
}

wcsncpy(pBuffer, targetFile.Buffer, targetFile.Length);

if( Data->Iopb->TargetFileObject->FileName.Buffer) {
ExFreePool(Data->Iopb->TargetFileObject->FileName.Buffer);
}

Data->Iopb->TargetFileObject->FileName.Buffer = pBuffer;
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;

FltSetCallbackDataDirty(Data);

//return STATUS_REPARSE;
return FLT_PREOP_COMPLETE;
}
}

return status;
}

3

Some quick feedback:

  1. You’ll need to prepend the device name as well (so you may get
    \testdir\a.txt, but you need to set up \device\volume\testdir\b.txt).
  2. I’m always nervous when I see these strange pseudo-c functions like
    wcsncpy being used. They aren’t documented in the DDK (are they?) and I get
    worried about their attitude to nulls and fenceposts. RtlCopyMemory is
    documented and works. Better still might be careful use of
    RtlCopyUnicodeString.
  3. You’ll need to set up the Length and possible the MaximumLength in the
    file object unicode string.

I’ll note in passing (becaused it catches me every time) that once you’ve
done this you can no longer safely unload your driver under verifier (it
complains about that pesky buffer you allocated).

Rod Widdowson

Consulting Partner
Steading System Software

wrote in message news:xxxxx@ntfsd…
> hi, I am very glad to read your post. I want to redirect a open file
> request, for example, when open file “\testdir\a.txt”, instead open file
> “\testdir\b.txt”. In minifilter precreate function, I wrote the following
> code. Would yo like to help me correct my error? thanx a lot!
>
> here is my code:
>
> LT_PREOP_CALLBACK_STATUS
> FsPreCreate (
> inout PFLT_CALLBACK_DATA Data,
> in PCFLT_RELATED_OBJECTS FltObjects,
> __deref_out_opt PVOID *CompletionContext
> )
> {
> NTSTATUS status = FLT_PREOP_SUCCESS_WITH_CALLBACK;
> UNICODE_STRING targetFile;
> PWCHAR pBuffer = NULL;
> ULONG len, maxlen;
>
> //judge if open file “\testdir\a.txt”, if it is, then…
> if (IsCheckedFile(&(Data->Iopb->TargetFileObject->FileName)))
> {
> RtlInitUnicodeString(&targetFile, L"\testdir\b.txt");
> len = targetFile.Length;
> maxlen = targetFile.MaximumLength;
>
> pBuffer = (PWCHAR) ExAllocatePool(NonPagedPool, maxlen);
> if(!pBuffer)
> {
> return status;
> }
>
> wcsncpy(pBuffer, targetFile.Buffer, targetFile.Length);
>
> if( Data->Iopb->TargetFileObject->FileName.Buffer) {
> ExFreePool(Data->Iopb->TargetFileObject->FileName.Buffer);
> }
>
> Data->Iopb->TargetFileObject->FileName.Buffer = pBuffer;
> Data->IoStatus.Status = STATUS_REPARSE;
> Data->IoStatus.Information = IO_REPARSE;
>
> FltSetCallbackDataDirty(Data);
>
> //return STATUS_REPARSE;
> return FLT_PREOP_COMPLETE;
> }
> }
>
> return status;
> }
>

4

Thanx very much. Thanx to Rod Widdowson :slight_smile:

Your advice is very good. Now my program runs well.
I
thanx again.

2007/7/24, Rod Widdowson :
>
> Some quick feedback:
>
> 1) You’ll need to prepend the device name as well (so you may get
> \testdir\a.txt, but you need to set up \device\volume\testdir\b.txt).
> 2) I’m always nervous when I see these strange pseudo-c functions like
> wcsncpy being used. They aren’t documented in the DDK (are they?) and I
> get
> worried about their attitude to nulls and fenceposts. RtlCopyMemory is
> documented and works. Better still might be careful use of
> RtlCopyUnicodeString.
> 3) You’ll need to set up the Length and possible the MaximumLength in the
> file object unicode string.
>
> I’ll note in passing (becaused it catches me every time) that once you’ve
> done this you can no longer safely unload your driver under verifier (it
> complains about that pesky buffer you allocated).
>
> Rod Widdowson
>
> Consulting Partner
> Steading System Software
>
> wrote in message news:xxxxx@ntfsd…
> > hi, I am very glad to read your post. I want to redirect a open file
> > request, for example, when open file “\testdir\a.txt”, instead open file
> > “\testdir\b.txt”. In minifilter precreate function, I wrote the
> following
> > code. Would yo like to help me correct my error? thanx a lot!
> >
> > here is my code:
> >
> > LT_PREOP_CALLBACK_STATUS
> > FsPreCreate (
> > inout PFLT_CALLBACK_DATA Data,
> > in PCFLT_RELATED_OBJECTS FltObjects,
> > __deref_out_opt PVOID *CompletionContext
> > )
> > {
> > NTSTATUS status = FLT_PREOP_SUCCESS_WITH_CALLBACK;
> > UNICODE_STRING targetFile;
> > PWCHAR pBuffer = NULL;
> > ULONG len, maxlen;
> >
> > //judge if open file “\testdir\a.txt”, if it is, then…
> > if (IsCheckedFile(&(Data->Iopb->TargetFileObject->FileName)))
> > {
> > RtlInitUnicodeString(&targetFile, L"\testdir\b.txt");
> > len = targetFile.Length;
> > maxlen = targetFile.MaximumLength;
> >
> > pBuffer = (PWCHAR) ExAllocatePool(NonPagedPool, maxlen);
> > if(!pBuffer)
> > {
> > return status;
> > }
> >
> > wcsncpy(pBuffer, targetFile.Buffer, targetFile.Length);
> >
> > if( Data->Iopb->TargetFileObject->FileName.Buffer) {
> > ExFreePool(Data->Iopb->TargetFileObject->FileName.Buffer);
> > }
> >
> > Data->Iopb->TargetFileObject->FileName.Buffer = pBuffer;
> > Data->IoStatus.Status = STATUS_REPARSE;
> > Data->IoStatus.Information = IO_REPARSE;
> >
> > FltSetCallbackDataDirty(Data);
> >
> > //return STATUS_REPARSE;
> > return FLT_PREOP_COMPLETE;
> > }
> > }
> >
> > return status;
> > }
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>