I found that if I fail the FastIO calls, then it
works.
I don’t really want to do that…
— Randy Cook wrote:
> By manipulating irps
> (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> tell NT that a file (C:\NOTEPAD.EXE) exists. It is
> not really there.
>
> When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE,
> I
> redirect (C:\REDIR\NOTEPAD.EXE) it using
> STATUS_REPARSE.
>
> This works great on a FAT partition. I see an open
> request to get the icon and launching the app works
> fine.
>
> When I try this on a NTFS partition I get a “Program
> Not Found” “Windows cannot find NOTEPAD.EXE” when
> trying to launch the app.
>
> Explorer does manage to get the icon for notepad
> even
> though I don’t see any IRP_MJ_CREATE requests for
> C:\NOTEPAD.EXE.
>
> When I attempt to launch notepad, I see several
> IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> redirect
> all of these using STATUS_REPARSE. All of these
> redirected requests complete with 0.
>
> I also see many IRP_MJ_CREATE requests trying to
> open
> NTFS streams on C:\NOTEPAD.EXE. I also redirect
> these.
>
> Looking through the archive of this list I see that
> there are some functions (IoCreateStreamFileObject,
> IoCreateStreamFileObjectLite) that can be used to
> get
> a file object bypassing the normal irp mechanism.
>
> My redirect algorithm is like this:
>
> If the FileObject->FileName buffer is too small for
> the new path, free the buffer (if != NULL), and
> ExAllocatePoolWithTag a new buffer.
>
> Put the redirect string into FileObject->FileName.
>
> Irp->IoStatus.Information = IO_REPARSE;
> Irp->IoStatus.Status = STATUS_REPARSE;
>
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> return STATUS_REPARSE;
>
>
> If anyone can shed some light on this it would be
> much
> appreciated. Thanks.
>
> Randy Cook
> Lucid Systems Inc.
>
>
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%
=====
Randy Cook
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/
Interesting. Which fast IO calls?
-----Original Message-----
From: Randy Cook [mailto:xxxxx@yahoo.com]
Sent: Thursday, October 31, 2002 4:52 PM
To: File Systems Developers
Subject: [ntfsd] More: STATUS_REPARSE and NTFS
I found that if I fail the FastIO calls, then it
works.
I don’t really want to do that…
— Randy Cook wrote:
> By manipulating irps
> (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> tell NT that a file (C:\NOTEPAD.EXE) exists. It is
> not really there.
>
> When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE,
> I
> redirect (C:\REDIR\NOTEPAD.EXE) it using
> STATUS_REPARSE.
>
> This works great on a FAT partition. I see an open
> request to get the icon and launching the app works
> fine.
>
> When I try this on a NTFS partition I get a “Program
> Not Found” “Windows cannot find NOTEPAD.EXE” when
> trying to launch the app.
>
> Explorer does manage to get the icon for notepad
> even
> though I don’t see any IRP_MJ_CREATE requests for
> C:\NOTEPAD.EXE.
>
> When I attempt to launch notepad, I see several
> IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> redirect
> all of these using STATUS_REPARSE. All of these
> redirected requests complete with 0.
>
> I also see many IRP_MJ_CREATE requests trying to
> open
> NTFS streams on C:\NOTEPAD.EXE. I also redirect
> these.
>
> Looking through the archive of this list I see that
> there are some functions (IoCreateStreamFileObject,
> IoCreateStreamFileObjectLite) that can be used to
> get
> a file object bypassing the normal irp mechanism.
>
> My redirect algorithm is like this:
>
> If the FileObject->FileName buffer is too small for
> the new path, free the buffer (if != NULL), and
> ExAllocatePoolWithTag a new buffer.
>
> Put the redirect string into FileObject->FileName.
>
> Irp->IoStatus.Information = IO_REPARSE;
> Irp->IoStatus.Status = STATUS_REPARSE;
>
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> return STATUS_REPARSE;
>
>
> If anyone can shed some light on this it would be
> much
> appreciated. Thanks.
>
> Randy Cook
> Lucid Systems Inc.
>
>
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%
=====
Randy Cook
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/
—
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%
FastIoQueryOpen is the only one I am failing now and
it is still working.
Maybe it isn’t FastIoQueryOpen that has the problem
though. Maybe some other fastio isn’t being called
because the FastIoQueryOpen is failed?
— “Fuller, Rob” wrote:
> Interesting. Which fast IO calls?
>
> -----Original Message-----
> From: Randy Cook [mailto:xxxxx@yahoo.com]
> Sent: Thursday, October 31, 2002 4:52 PM
> To: File Systems Developers
> Subject: [ntfsd] More: STATUS_REPARSE and NTFS
>
>
> I found that if I fail the FastIO calls, then it
> works.
>
> I don’t really want to do that…
>
> — Randy Cook wrote:
> > By manipulating irps
> > (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY)
> I
> > tell NT that a file (C:\NOTEPAD.EXE) exists. It
> is
> > not really there.
> >
> > When a IRP_MJ_CREATE comes along for
> C:\NOTEPAD.EXE,
> > I
> > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > STATUS_REPARSE.
> >
> > This works great on a FAT partition. I see an
> open
> > request to get the icon and launching the app
> works
> > fine.
> >
> > When I try this on a NTFS partition I get a
> “Program
> > Not Found” “Windows cannot find NOTEPAD.EXE” when
> > trying to launch the app.
> >
> > Explorer does manage to get the icon for notepad
> > even
> > though I don’t see any IRP_MJ_CREATE requests for
> > C:\NOTEPAD.EXE.
> >
> > When I attempt to launch notepad, I see several
> > IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> > redirect
> > all of these using STATUS_REPARSE. All of these
> > redirected requests complete with 0.
> >
> > I also see many IRP_MJ_CREATE requests trying to
> > open
> > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > these.
> >
> > Looking through the archive of this list I see
> that
> > there are some functions
> (IoCreateStreamFileObject,
> > IoCreateStreamFileObjectLite) that can be used to
> > get
> > a file object bypassing the normal irp mechanism.
> >
> > My redirect algorithm is like this:
> >
> > If the FileObject->FileName buffer is too small
> for
> > the new path, free the buffer (if != NULL), and
> > ExAllocatePoolWithTag a new buffer.
> >
> > Put the redirect string into FileObject->FileName.
> >
> > Irp->IoStatus.Information = IO_REPARSE;
> > Irp->IoStatus.Status = STATUS_REPARSE;
> >
> > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > return STATUS_REPARSE;
> >
> >
> > If anyone can shed some light on this it would be
> > much
> > appreciated. Thanks.
> >
> > Randy Cook
> > Lucid Systems Inc.
> >
> >
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> >
> >
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> %%email.unsub%%
>
>
> =====
> Randy Cook
>
>
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@inin.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%
=====
Randy Cook
__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/
Ahh. You have to handle FastIoQueryOpen also if you’re spoofing
pathnames.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Thursday, October 31, 2002 1:52 PM
To: File Systems Developers
Subject: [ntfsd] More: STATUS_REPARSE and NTFS
I found that if I fail the FastIO calls, then it
works.
I don’t really want to do that…
— Randy Cook wrote:
> > By manipulating irps
> > (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> > tell NT that a file (C:\NOTEPAD.EXE) exists. It is
> > not really there.
> >
> > When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE,
> > I
> > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > STATUS_REPARSE.
> >
> > This works great on a FAT partition. I see an open
> > request to get the icon and launching the app works
> > fine.
> >
> > When I try this on a NTFS partition I get a “Program
> > Not Found” “Windows cannot find NOTEPAD.EXE” when
> > trying to launch the app.
> >
> > Explorer does manage to get the icon for notepad
> > even
> > though I don’t see any IRP_MJ_CREATE requests for C:\NOTEPAD.EXE.
> >
> > When I attempt to launch notepad, I see several
> > IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> > redirect
> > all of these using STATUS_REPARSE. All of these
> > redirected requests complete with 0.
> >
> > I also see many IRP_MJ_CREATE requests trying to
> > open
> > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > these.
> >
> > Looking through the archive of this list I see that
> > there are some functions (IoCreateStreamFileObject,
> > IoCreateStreamFileObjectLite) that can be used to
> > get
> > a file object bypassing the normal irp mechanism.
> >
> > My redirect algorithm is like this:
> >
> > If the FileObject->FileName buffer is too small for
> > the new path, free the buffer (if != NULL), and
> ExAllocatePoolWithTag
> > a new buffer.
> >
> > Put the redirect string into FileObject->FileName.
> >
> > Irp->IoStatus.Information = IO_REPARSE;
> > Irp->IoStatus.Status = STATUS_REPARSE;
> >
> > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > return STATUS_REPARSE;
> >
> >
> > If anyone can shed some light on this it would be
> > much
> > appreciated. Thanks.
> >
> > Randy Cook
> > Lucid Systems Inc.
> >
> >
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> %%email.unsub%%
>
>
> =====
> Randy Cook
>
>
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to %%email.unsub%%
>
What’s the recommended approach here? Do I munge the
path in the irp (FastIoQueryOpen passes an irp) and
let it continue? Or do I notice that it is a request
for something that should be redirected and fail the
fastio call? Or should I fail all FastIoQueryOpen
calls?
Thanks,
— Nicholas Ryan wrote:
> Ahh. You have to handle FastIoQueryOpen also if
> you’re spoofing
> pathnames.
>
> - Nicholas Ryan
>
>
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf
> Of Randy Cook
> > Sent: Thursday, October 31, 2002 1:52 PM
> > To: File Systems Developers
> > Subject: [ntfsd] More: STATUS_REPARSE and NTFS
> >
> >
> > I found that if I fail the FastIO calls, then it
> > works.
> >
> > I don’t really want to do that…
> >
> > — Randy Cook wrote:
> > > By manipulating irps
> > >
> (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> > > tell NT that a file (C:\NOTEPAD.EXE) exists. It
> is
> > > not really there.
> > >
> > > When a IRP_MJ_CREATE comes along for
> C:\NOTEPAD.EXE,
> > > I
> > > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > > STATUS_REPARSE.
> > >
> > > This works great on a FAT partition. I see an
> open
> > > request to get the icon and launching the app
> works
> > > fine.
> > >
> > > When I try this on a NTFS partition I get a
> “Program
> > > Not Found” “Windows cannot find NOTEPAD.EXE”
> when
> > > trying to launch the app.
> > >
> > > Explorer does manage to get the icon for notepad
> > > even
> > > though I don’t see any IRP_MJ_CREATE requests
> for C:\NOTEPAD.EXE.
> > >
> > > When I attempt to launch notepad, I see several
> > > IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> > > redirect
> > > all of these using STATUS_REPARSE. All of these
> > > redirected requests complete with 0.
> > >
> > > I also see many IRP_MJ_CREATE requests trying to
> > > open
> > > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > > these.
> > >
> > > Looking through the archive of this list I see
> that
> > > there are some functions
> (IoCreateStreamFileObject,
> > > IoCreateStreamFileObjectLite) that can be used
> to
> > > get
> > > a file object bypassing the normal irp
> mechanism.
> > >
> > > My redirect algorithm is like this:
> > >
> > > If the FileObject->FileName buffer is too small
> for
> > > the new path, free the buffer (if != NULL), and
> > ExAllocatePoolWithTag
> > > a new buffer.
> > >
> > > Put the redirect string into
> FileObject->FileName.
> > >
> > > Irp->IoStatus.Information = IO_REPARSE;
> > > Irp->IoStatus.Status = STATUS_REPARSE;
> > >
> > > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > > return STATUS_REPARSE;
> > >
> > >
> > > If anyone can shed some light on this it would
> be
> > > much
> > > appreciated. Thanks.
> > >
> > > Randy Cook
> > > Lucid Systems Inc.
> > >
> > >
>
> > > Do you Yahoo!?
> > > HotJobs - Search new jobs daily now
> > > http://hotjobs.yahoo.com/
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > %%email.unsub%%
> >
> >
> > =====
> > Randy Cook
> >
> >
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> >
> >
> > —
> > You are currently subscribed to ntfsd as:
> xxxxx@nryan.com
> > To unsubscribe send a blank email to
> %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%
__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/
You can munge the path, but this only works if the target file is on the
same device as the original file, since you are sending it to the same
device object (you can send it to a DIFFERENT device object if you want
to, but it gets hairy - you have to worry about FileObject->DeviceObject
also, and other things as well). I’d just fail the call for redirected
files. It’s harmless since the system will just replace the failed
FastIoQueryOpen with a Create/Query/Close triplet.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Thursday, October 31, 2002 3:22 PM
To: File Systems Developers
Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
What’s the recommended approach here? Do I munge the
path in the irp (FastIoQueryOpen passes an irp) and
let it continue? Or do I notice that it is a request
for something that should be redirected and fail the
fastio call? Or should I fail all FastIoQueryOpen
calls?
Thanks,
— Nicholas Ryan wrote:
> > Ahh. You have to handle FastIoQueryOpen also if
> > you’re spoofing
> > pathnames.
> >
> > - Nicholas Ryan
> >
> >
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf
> > Of Randy Cook
> > > Sent: Thursday, October 31, 2002 1:52 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] More: STATUS_REPARSE and NTFS
> > >
> > >
> > > I found that if I fail the FastIO calls, then it
> > > works.
> > >
> > > I don’t really want to do that…
> > >
> > > — Randy Cook wrote:
> > > > By manipulating irps
> > > >
> > (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> > > > tell NT that a file (C:\NOTEPAD.EXE) exists. It
> > is
> > > > not really there.
> > > >
> > > > When a IRP_MJ_CREATE comes along for
> > C:\NOTEPAD.EXE,
> > > > I
> > > > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > > > STATUS_REPARSE.
> > > >
> > > > This works great on a FAT partition. I see an
> > open
> > > > request to get the icon and launching the app
> > works
> > > > fine.
> > > >
> > > > When I try this on a NTFS partition I get a
> > “Program
> > > > Not Found” “Windows cannot find NOTEPAD.EXE”
> > when
> > > > trying to launch the app.
> > > >
> > > > Explorer does manage to get the icon for notepad
> > > > even
> > > > though I don’t see any IRP_MJ_CREATE requests
> > for C:\NOTEPAD.EXE.
> > > >
> > > > When I attempt to launch notepad, I see several IRP_MJ_CREATE
> > > > requests for C:\NOTEPAD.EXE. I redirect
> > > > all of these using STATUS_REPARSE. All of these
> > > > redirected requests complete with 0.
> > > >
> > > > I also see many IRP_MJ_CREATE requests trying to
> > > > open
> > > > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > > > these.
> > > >
> > > > Looking through the archive of this list I see
> > that
> > > > there are some functions
> > (IoCreateStreamFileObject,
> > > > IoCreateStreamFileObjectLite) that can be used
> > to
> > > > get
> > > > a file object bypassing the normal irp
> > mechanism.
> > > >
> > > > My redirect algorithm is like this:
> > > >
> > > > If the FileObject->FileName buffer is too small
> > for
> > > > the new path, free the buffer (if != NULL), and
> > > ExAllocatePoolWithTag
> > > > a new buffer.
> > > >
> > > > Put the redirect string into
> > FileObject->FileName.
> > > >
> > > > Irp->IoStatus.Information = IO_REPARSE;
> > > > Irp->IoStatus.Status = STATUS_REPARSE;
> > > >
> > > > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > > > return STATUS_REPARSE;
> > > >
> > > >
> > > > If anyone can shed some light on this it would
> > be
> > > > much
> > > > appreciated. Thanks.
> > > >
> > > > Randy Cook
> > > > Lucid Systems Inc.
> > > >
> > > >
> >
> > > > Do you Yahoo!?
> > > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > > > To unsubscribe send a blank email to
> > > %%email.unsub%%
> > >
> > >
> > > =====
> > > Randy Cook
> > >
> > >
> > > Do you Yahoo!?
> > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as:
> > xxxxx@nryan.com
> > > To unsubscribe send a blank email to
> > %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> %%email.unsub%%
>
>
> __________________________________________________
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to %%email.unsub%%
>
Are there any other issues if we need to redirect the request over RDR.
-Mehtab
----- Original Message -----
From: “Nicholas Ryan”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 6:05 AM
Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
> You can munge the path, but this only works if the target file is on the
> same device as the original file, since you are sending it to the same
> device object (you can send it to a DIFFERENT device object if you want
> to, but it gets hairy - you have to worry about FileObject->DeviceObject
> also, and other things as well). I’d just fail the call for redirected
> files. It’s harmless since the system will just replace the failed
> FastIoQueryOpen with a Create/Query/Close triplet.
>
> - Nicholas Ryan
>
>
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
> > Sent: Thursday, October 31, 2002 3:22 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
> >
> >
> > What’s the recommended approach here? Do I munge the
> > path in the irp (FastIoQueryOpen passes an irp) and
> > let it continue? Or do I notice that it is a request
> > for something that should be redirected and fail the
> > fastio call? Or should I fail all FastIoQueryOpen
> > calls?
> >
> > Thanks,
> >
> > — Nicholas Ryan wrote:
> > > Ahh. You have to handle FastIoQueryOpen also if
> > > you’re spoofing
> > > pathnames.
> > >
> > > - Nicholas Ryan
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On Behalf
> > > Of Randy Cook
> > > > Sent: Thursday, October 31, 2002 1:52 PM
> > > > To: File Systems Developers
> > > > Subject: [ntfsd] More: STATUS_REPARSE and NTFS
> > > >
> > > >
> > > > I found that if I fail the FastIO calls, then it
> > > > works.
> > > >
> > > > I don’t really want to do that…
> > > >
> > > > — Randy Cook wrote:
> > > > > By manipulating irps
> > > > >
> > > (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> > > > > tell NT that a file (C:\NOTEPAD.EXE) exists. It
> > > is
> > > > > not really there.
> > > > >
> > > > > When a IRP_MJ_CREATE comes along for
> > > C:\NOTEPAD.EXE,
> > > > > I
> > > > > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > > > > STATUS_REPARSE.
> > > > >
> > > > > This works great on a FAT partition. I see an
> > > open
> > > > > request to get the icon and launching the app
> > > works
> > > > > fine.
> > > > >
> > > > > When I try this on a NTFS partition I get a
> > > “Program
> > > > > Not Found” “Windows cannot find NOTEPAD.EXE”
> > > when
> > > > > trying to launch the app.
> > > > >
> > > > > Explorer does manage to get the icon for notepad
> > > > > even
> > > > > though I don’t see any IRP_MJ_CREATE requests
> > > for C:\NOTEPAD.EXE.
> > > > >
> > > > > When I attempt to launch notepad, I see several IRP_MJ_CREATE
> > > > > requests for C:\NOTEPAD.EXE. I redirect
> > > > > all of these using STATUS_REPARSE. All of these
> > > > > redirected requests complete with 0.
> > > > >
> > > > > I also see many IRP_MJ_CREATE requests trying to
> > > > > open
> > > > > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > > > > these.
> > > > >
> > > > > Looking through the archive of this list I see
> > > that
> > > > > there are some functions
> > > (IoCreateStreamFileObject,
> > > > > IoCreateStreamFileObjectLite) that can be used
> > > to
> > > > > get
> > > > > a file object bypassing the normal irp
> > > mechanism.
> > > > >
> > > > > My redirect algorithm is like this:
> > > > >
> > > > > If the FileObject->FileName buffer is too small
> > > for
> > > > > the new path, free the buffer (if != NULL), and
> > > > ExAllocatePoolWithTag
> > > > > a new buffer.
> > > > >
> > > > > Put the redirect string into
> > > FileObject->FileName.
> > > > >
> > > > > Irp->IoStatus.Information = IO_REPARSE;
> > > > > Irp->IoStatus.Status = STATUS_REPARSE;
> > > > >
> > > > > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > > > > return STATUS_REPARSE;
> > > > >
> > > > >
> > > > > If anyone can shed some light on this it would
> > > be
> > > > > much
> > > > > appreciated. Thanks.
> > > > >
> > > > > Randy Cook
> > > > > Lucid Systems Inc.
> > > > >
> > > > >
> > >
> > > > > Do you Yahoo!?
> > > > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as:
> > > xxxxx@yahoo.com
> > > > > To unsubscribe send a blank email to
> > > > %%email.unsub%%
> > > >
> > > >
> > > > =====
> > > > Randy Cook
> > > >
> > > >
> > > > Do you Yahoo!?
> > > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as:
> > > xxxxx@nryan.com
> > > > To unsubscribe send a blank email to
> > > %%email.unsub%%
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > %%email.unsub%%
> >
> >
> > __________________________________________________
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@veritas.com
> To unsubscribe send a blank email to %%email.unsub%%
I would recommend that if you are doing reparse, to fail the fastio call
with FALSE and force the IRP path. Using the IRP path provides greater
flexibility for reparsing. I works well.
Jamey
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Syed Mehtab Ali
Sent: Thursday, October 31, 2002 10:59 PM
To: File Systems Developers
Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
Are there any other issues if we need to redirect the request over RDR.
-Mehtab
----- Original Message -----
From: “Nicholas Ryan”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 6:05 AM
Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
> You can munge the path, but this only works if the target file is on
the
> same device as the original file, since you are sending it to the same
> device object (you can send it to a DIFFERENT device object if you
want
> to, but it gets hairy - you have to worry about
FileObject->DeviceObject
> also, and other things as well). I’d just fail the call for redirected
> files. It’s harmless since the system will just replace the failed
> FastIoQueryOpen with a Create/Query/Close triplet.
>
> - Nicholas Ryan
>
>
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
> > Sent: Thursday, October 31, 2002 3:22 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: More: STATUS_REPARSE and NTFS
> >
> >
> > What’s the recommended approach here? Do I munge the
> > path in the irp (FastIoQueryOpen passes an irp) and
> > let it continue? Or do I notice that it is a request
> > for something that should be redirected and fail the
> > fastio call? Or should I fail all FastIoQueryOpen
> > calls?
> >
> > Thanks,
> >
> > — Nicholas Ryan wrote:
> > > Ahh. You have to handle FastIoQueryOpen also if
> > > you’re spoofing
> > > pathnames.
> > >
> > > - Nicholas Ryan
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On Behalf
> > > Of Randy Cook
> > > > Sent: Thursday, October 31, 2002 1:52 PM
> > > > To: File Systems Developers
> > > > Subject: [ntfsd] More: STATUS_REPARSE and NTFS
> > > >
> > > >
> > > > I found that if I fail the FastIO calls, then it
> > > > works.
> > > >
> > > > I don’t really want to do that…
> > > >
> > > > — Randy Cook wrote:
> > > > > By manipulating irps
> > > > >
> > > (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> > > > > tell NT that a file (C:\NOTEPAD.EXE) exists. It
> > > is
> > > > > not really there.
> > > > >
> > > > > When a IRP_MJ_CREATE comes along for
> > > C:\NOTEPAD.EXE,
> > > > > I
> > > > > redirect (C:\REDIR\NOTEPAD.EXE) it using
> > > > > STATUS_REPARSE.
> > > > >
> > > > > This works great on a FAT partition. I see an
> > > open
> > > > > request to get the icon and launching the app
> > > works
> > > > > fine.
> > > > >
> > > > > When I try this on a NTFS partition I get a
> > > “Program
> > > > > Not Found” “Windows cannot find NOTEPAD.EXE”
> > > when
> > > > > trying to launch the app.
> > > > >
> > > > > Explorer does manage to get the icon for notepad
> > > > > even
> > > > > though I don’t see any IRP_MJ_CREATE requests
> > > for C:\NOTEPAD.EXE.
> > > > >
> > > > > When I attempt to launch notepad, I see several IRP_MJ_CREATE
> > > > > requests for C:\NOTEPAD.EXE. I redirect
> > > > > all of these using STATUS_REPARSE. All of these
> > > > > redirected requests complete with 0.
> > > > >
> > > > > I also see many IRP_MJ_CREATE requests trying to
> > > > > open
> > > > > NTFS streams on C:\NOTEPAD.EXE. I also redirect
> > > > > these.
> > > > >
> > > > > Looking through the archive of this list I see
> > > that
> > > > > there are some functions
> > > (IoCreateStreamFileObject,
> > > > > IoCreateStreamFileObjectLite) that can be used
> > > to
> > > > > get
> > > > > a file object bypassing the normal irp
> > > mechanism.
> > > > >
> > > > > My redirect algorithm is like this:
> > > > >
> > > > > If the FileObject->FileName buffer is too small
> > > for
> > > > > the new path, free the buffer (if != NULL), and
> > > > ExAllocatePoolWithTag
> > > > > a new buffer.
> > > > >
> > > > > Put the redirect string into
> > > FileObject->FileName.
> > > > >
> > > > > Irp->IoStatus.Information = IO_REPARSE;
> > > > > Irp->IoStatus.Status = STATUS_REPARSE;
> > > > >
> > > > > IoCompleteRequest(Irp, IO_NO_INCREMENT);
> > > > > return STATUS_REPARSE;
> > > > >
> > > > >
> > > > > If anyone can shed some light on this it would
> > > be
> > > > > much
> > > > > appreciated. Thanks.
> > > > >
> > > > > Randy Cook
> > > > > Lucid Systems Inc.
> > > > >
> > > > >
> > >
> > > > > Do you Yahoo!?
> > > > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as:
> > > xxxxx@yahoo.com
> > > > > To unsubscribe send a blank email to
> > > > %%email.unsub%%
> > > >
> > > >
> > > > =====
> > > > Randy Cook
> > > >
> > > >
> > > > Do you Yahoo!?
> > > > HotJobs - Search new jobs daily now http://hotjobs.yahoo.com/
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as:
> > > xxxxx@nryan.com
> > > > To unsubscribe send a blank email to
> > > %%email.unsub%%
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > %%email.unsub%%
> >
> >
> > __________________________________________________
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@veritas.com
> To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%