Multiple memory images of the same physical file?

NTFSD
1

Hi,

I want to create two memory images from the same phsical file on disk
using a filter driver. Basically I need two domains. Programs in one
domain will run one version of an executable while the programs in
another domain with use another version. This needs to be done using
the same physical executable and not multiple copies of the same
executable.

In short, I need a way where I can fool the underlying filesystem, Mm,
Cc and the higher layer applications to believe that there are two
files instead of just one.

Questions:

  1. Is it possible using a Filter Driver? Is it possible using the
    documented interfaces in the IFS DDK?

  2. To do this, I think I would need to generate my own IRP’s and
    maintain my own FileControlBlocks(this seems like a very hard thing to
    do).

  3. Are there instances of people/companies who have done something
    similar before?

  4. Is there any material/documents/books which might prove helpful in
    addition to the IFS Kit documents and the Filesystems book by Nagar.

  5. What are the possible issues and stuff I should be careful about?

  6. Is there a simpler way to achieve the desired result?

Thanks

2

You will need 2 virtual FS volumes at least.

BTW - how you define your “domain”?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “foo bar”
To: “Windows File Systems Devs Interest List”
Sent: Sunday, January 09, 2005 8:50 PM
Subject: [ntfsd] Multiple memory images of the same physical file?

> Hi,
>
> I want to create two memory images from the same phsical file on disk
> using a filter driver. Basically I need two domains. Programs in one
> domain will run one version of an executable while the programs in
> another domain with use another version. This needs to be done using
> the same physical executable and not multiple copies of the same
> executable.
>
> In short, I need a way where I can fool the underlying filesystem, Mm,
> Cc and the higher layer applications to believe that there are two
> files instead of just one.
>
> Questions:
>
> 1) Is it possible using a Filter Driver? Is it possible using the
> documented interfaces in the IFS DDK?
>
> 2) To do this, I think I would need to generate my own IRP’s and
> maintain my own FileControlBlocks(this seems like a very hard thing to
> do).
>
> 3) Are there instances of people/companies who have done something
> similar before?
>
> 4) Is there any material/documents/books which might prove helpful in
> addition to the IFS Kit documents and the Filesystems book by Nagar.
>
> 5) What are the possible issues and stuff I should be careful about?
>
> 6) Is there a simpler way to achieve the desired result?
>
> Thanks
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

It just requires separate section object pointers structures to achieve
this - similar to the way we usually solve the modified data
(encrypt/compress) issue. One SOP represents one view of the file; the
other represents the second view. This can be done in a file system
“filter” but when you are done, what you end up with is more like a
layered file system.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Sunday, January 09, 2005 1:04 PM
To: ntfsd redirect
Subject: Re: [ntfsd] Multiple memory images of the same physical file?

You will need 2 virtual FS volumes at least.

BTW - how you define your “domain”?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “foo bar”
To: “Windows File Systems Devs Interest List”
Sent: Sunday, January 09, 2005 8:50 PM
Subject: [ntfsd] Multiple memory images of the same physical file?

> Hi,
>
> I want to create two memory images from the same phsical file on disk
> using a filter driver. Basically I need two domains. Programs in one
> domain will run one version of an executable while the programs in
> another domain with use another version. This needs to be done using
> the same physical executable and not multiple copies of the same
> executable.
>
> In short, I need a way where I can fool the underlying filesystem, Mm,
> Cc and the higher layer applications to believe that there are two
> files instead of just one.
>
> Questions:
>
> 1) Is it possible using a Filter Driver? Is it possible using the
> documented interfaces in the IFS DDK?
>
> 2) To do this, I think I would need to generate my own IRP’s and
> maintain my own FileControlBlocks(this seems like a very hard thing to
> do).
>
> 3) Are there instances of people/companies who have done something
> similar before?
>
> 4) Is there any material/documents/books which might prove helpful in
> addition to the IFS Kit documents and the Filesystems book by Nagar.
>
> 5) What are the possible issues and stuff I should be careful about?
>
> 6) Is there a simpler way to achieve the desired result?
>
> Thanks
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Great! we thought about this idea but I have a few questions:

  1. Since SOP’s are tied to FCB’s we will need to ensure that when the
    same file is opened via a different File Object, we force the Mm to
    allocate a new SOP.
    This could be done by NULL’ing the IRP_MJ_READ, I would guess? This would
    force the Mm to allocate a new SOP and create a FileObject <-> SOP mapping.

  2. In all other IRP’s and FastIO requests, we would need to juggle
    with the SOP’s, right? i.e. setup the right SOP based on the
    FileObject?

  3. Are there any cases in which the SOP’s might be used without the
    filter driver coming to know of it?

  4. Would there be issues related to reference counting/cleanup of the
    section objects when the FCB is finally discarded?

Is there any document/link which might prove helpful in this exercise?

What are the other issues I should be CAREFUL about?

Thanks

On Sun, 9 Jan 2005 13:59:48 -0500, Tony Mason wrote:
> It just requires separate section object pointers structures to achieve
> this - similar to the way we usually solve the modified data
> (encrypt/compress) issue. One SOP represents one view of the file; the
> other represents the second view. This can be done in a file system
> “filter” but when you are done, what you end up with is more like a
> layered file system.
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
> Sent: Sunday, January 09, 2005 1:04 PM
> To: ntfsd redirect
> Subject: Re: [ntfsd] Multiple memory images of the same physical file?
>
> You will need 2 virtual FS volumes at least.
>
> BTW - how you define your “domain”?
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “foo bar”
> To: “Windows File Systems Devs Interest List”
> Sent: Sunday, January 09, 2005 8:50 PM
> Subject: [ntfsd] Multiple memory images of the same physical file?
>
> > Hi,
> >
> > I want to create two memory images from the same phsical file on disk
> > using a filter driver. Basically I need two domains. Programs in one
> > domain will run one version of an executable while the programs in
> > another domain with use another version. This needs to be done using
> > the same physical executable and not multiple copies of the same
> > executable.
> >
> > In short, I need a way where I can fool the underlying filesystem, Mm,
> > Cc and the higher layer applications to believe that there are two
> > files instead of just one.
> >
> > Questions:
> >
> > 1) Is it possible using a Filter Driver? Is it possible using the
> > documented interfaces in the IFS DDK?
> >
> > 2) To do this, I think I would need to generate my own IRP’s and
> > maintain my own FileControlBlocks(this seems like a very hard thing to
> > do).
> >
> > 3) Are there instances of people/companies who have done something
> > similar before?
> >
> > 4) Is there any material/documents/books which might prove helpful in
> > addition to the IFS Kit documents and the Filesystems book by Nagar.
> >
> > 5) What are the possible issues and stuff I should be careful about?
> >
> > 6) Is there a simpler way to achieve the desired result?
> >
> > Thanks
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

> This could be done by NULL’ing the IRP_MJ_READ, I would guess? This would

force the Mm to allocate a new SOP and create a FileObject <-> SOP mapping.

Mm does not allocate SOP, it only wills the SOP pointer at by the file object.

Listen to Tony. You will need a “filesystem over filesystem” thing, otherwise,
you will never master this project out of heaps of major intermittent bugs.

  1. In all other IRP’s and FastIO requests, we would need to juggle
    with the SOP’s, right?

No, SOP is an area private for MM. FSDs never touch its content.

  1. Would there be issues related to reference counting/cleanup of the
    section objects when the FCB is finally discarded?

Cache map -> control area -> file object it was created from -> FCB

When the CC’s garbage collector will kill the cache map - then the file object
destroyed (MJ_CLOSE), and this is turn destroys the FCB.

User mapped views also reference the control area.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com