Hi All,
Again, I have a renaming problem on MS Word.
I have a FS filter driver which needs to redirect some file operations.
Say, opening a file c:\Tag\a.doc will be redirected to
d:\Real\a.doc. That means the a.doc in c:\Tag is a tag file which file
size is always 0 byte and the a.doc in d:\Real is a real file which
contains the real content. When the user opens the a.doc in c:\Tag, FS
filter will give the content in d:\Real\a.doc. So even though the tag
file in c:\Tag is empty, the real file still can be opened(in here, I’ll
not talk about how to spoof the tag file size so that the user can see
none-zero file size on tag file). For some reasons, I CAN NOT use
STATUS_REPARSE to redidect the tag file operations. Only one thing I can
do is following current design and using Zwxxx function to redirect the
tag file operation.
Right now, every thing works fine except MS Word document saving. When
Word starts its two steps renaming to saving the document, I intercept
IRP_MJ_CREATE with flag SL_OPEN_TARGET_DIRECTORY. After Word finishes
renaming operations, I do the real file renaming operations. But the
renaming result is not correct. In d:\Real\ folder, the tmp file
~WRDxxxx.tmp is renamed to a.doc and contains the new content. That is I
expect. However, in c:\Tag\ folder, the tmp file ~WRDxxxx.tmp is renamed
to a.doc but it is NOT empty anymore. It contains a part of real content
in d:\Real\a.doc. This result make me really confused because all files
in c:\Tag folder is empty and there is no real file operation on those
tag files.
I monitor all IRP_MJ_WRITE and can not find any IRP_MJ_WRITE apply to
tag files in c:\Tag\ folder. So I can not figure out why the tag file
become not empty after renaming and where it get the real content.
Can anybody help me out? Any info will be appriciated.
Thanks
Each Office program has a different behavior in creating and updating files.
Sometimes various versions of the Office programs vary in how they do it
too. Build several different systems, install various versions of Office,
and using filemon trace the file activities. You could also do it with your
driver and only have to worry about the file(s) and programs you want to
track. Been there, done that.
“David Wu” wrote in message news:xxxxx@ntfsd…
>
> Hi All,
> Again, I have a renaming problem on MS Word.
> I have a FS filter driver which needs to redirect some file operations.
> Say, opening a file c:\Tag\a.doc will be redirected to
> d:\Real\a.doc. That means the a.doc in c:\Tag is a tag file which file
> size is always 0 byte and the a.doc in d:\Real is a real file which
> contains the real content. When the user opens the a.doc in c:\Tag, FS
> filter will give the content in d:\Real\a.doc. So even though the tag
> file in c:\Tag is empty, the real file still can be opened(in here, I’ll
> not talk about how to spoof the tag file size so that the user can see
> none-zero file size on tag file). For some reasons, I CAN NOT use
> STATUS_REPARSE to redidect the tag file operations. Only one thing I can
> do is following current design and using Zwxxx function to redirect the
> tag file operation.
> Right now, every thing works fine except MS Word document saving. When
> Word starts its two steps renaming to saving the document, I intercept
> IRP_MJ_CREATE with flag SL_OPEN_TARGET_DIRECTORY. After Word finishes
> renaming operations, I do the real file renaming operations. But the
> renaming result is not correct. In d:\Real\ folder, the tmp file
> ~WRDxxxx.tmp is renamed to a.doc and contains the new content. That is I
> expect. However, in c:\Tag\ folder, the tmp file ~WRDxxxx.tmp is renamed
> to a.doc but it is NOT empty anymore. It contains a part of real content
> in d:\Real\a.doc. This result make me really confused because all files
> in c:\Tag folder is empty and there is no real file operation on those
> tag files.
> I monitor all IRP_MJ_WRITE and can not find any IRP_MJ_WRITE apply to
> tag files in c:\Tag\ folder. So I can not figure out why the tag file
> become not empty after renaming and where it get the real content.
> Can anybody help me out? Any info will be appriciated.
>
> Thanks
>
>