Good day,
I have a minifilter driver that is monitoring the file system for
interesting activity (interesting to a user-mode application). When
something of interest happens, an event is sent to a user-mode
application.
Within the user-mode application, I have created a mapping
function that can map the NTFS path into a Win32 style path so the
path can be accessed with Win32 calls if need be. (ie: \Device
\HarddiskVolume3 <==> D:, for example).
To ensure that my map is up to date as external drives, etc. are
attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
notify the user-process that a new volume has been attached. This all
works fine with USB, firewire, etc. drives.
My problem is with network shares (through SMB, for example). I
never seem to get a notification, so can not update my NTFS<->Win32
mappings. Is there another way to do this? I can see messages coming
up when I access files on the network share (I’ll see something like
\Device\Mup\HaliGrid\networkstorage\test\test.txt, for example), so I
know my filter has attached, but my instance setup callback never gets
called.
Searching through the mailing lists, it appears that there are
some sort of LAN redirectors, but I haven’t been able to find a good
explanation for how this all works.
Can someone give me an explanation of what is going on and if
there is a way to do what I want?
Thanks!
Andrew Cheyne
PS: Before someone mentions it - yes, I know files can be accessed
without a drive being mapped. I’ll handle this eventually… I just
want to know that a volume has been mounted on the system!
All network requests are directed to the same volume object so you will not
receive instance callbacks for individual shares and I don’t think you can
manually attach them. I do not understand the problem of the file name
mapping though, all networks paths have the same syntax, then what is the
problem in translating them or insisting these are updated from an instance
callback ?
//Daniel
“Andrew Cheyne” wrote in message
news:xxxxx@ntfsd…
> Good day,
>
> I have a minifilter driver that is monitoring the file system for
> interesting activity (interesting to a user-mode application). When
> something of interest happens, an event is sent to a user-mode
> application.
>
> Within the user-mode application, I have created a mapping function
> that can map the NTFS path into a Win32 style path so the path can be
> accessed with Win32 calls if need be. (ie: \Device \HarddiskVolume3 <==>
> D:, for example).
>
> To ensure that my map is up to date as external drives, etc. are
> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to notify
> the user-process that a new volume has been attached. This all works fine
> with USB, firewire, etc. drives.
>
> My problem is with network shares (through SMB, for example). I never
> seem to get a notification, so can not update my NTFS<->Win32 mappings.
> Is there another way to do this? I can see messages coming up when I
> access files on the network share (I’ll see something like
> \Device\Mup\HaliGrid\networkstorage\test\test.txt, for example), so I
> know my filter has attached, but my instance setup callback never gets
> called.
>
> Searching through the mailing lists, it appears that there are some
> sort of LAN redirectors, but I haven’t been able to find a good
> explanation for how this all works.
>
> Can someone give me an explanation of what is going on and if there is
> a way to do what I want?
>
> Thanks!
> Andrew Cheyne
>
> PS: Before someone mentions it - yes, I know files can be accessed
> without a drive being mapped. I’ll handle this eventually… I just want
> to know that a volume has been mounted on the system!
>
>
Try to register for shell notifications in user mode. It is API ShChangeNotifyRegister(). Mapping of remote drive should generate SHCNE_DRIVEADD event. WM_DEVICECHANGE might be also generated, but I am not sure.
-bg
Daniel,
Thanks. I thought as much (one instance of the driver per volume
object for network access) after poking around.
The reason I need the mapping is simply because NTFS paths don’t
mean much to Win32 calls, so when I’m in my user-mode app and need to
do something useful with the files I’m monitoring, I need to convert
the path from the NTFS path structure to a Win32 structure. My current
implementation does this by creating a mapping from NTFS file path to
Win32 file path - is there already an API that will do this for me? It
would make my life a lot easier!
Thanks,
Andrew
On 29-May-08, at 5:01 PM, > wrote:
> All network requests are directed to the same volume object so you
> will not receive instance callbacks for individual shares and I
> don’t think you can manually attach them. I do not understand the
> problem of the file name mapping though, all networks paths have the
> same syntax, then what is the problem in translating them or
> insisting these are updated from an instance callback ?
>
> //Daniel
>
>
> “Andrew Cheyne” wrote in message news:xxxxx@ntfsd
> …
>> Good day,
>>
>> I have a minifilter driver that is monitoring the file system for
>> interesting activity (interesting to a user-mode application). When
>> something of interest happens, an event is sent to a user-mode
>> application.
>>
>> Within the user-mode application, I have created a mapping
>> function that can map the NTFS path into a Win32 style path so the
>> path can be accessed with Win32 calls if need be. (ie: \Device
>> \HarddiskVolume3 <==> D:, for example).
>>
>> To ensure that my map is up to date as external drives, etc. are
>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>> notify the user-process that a new volume has been attached. This
>> all works fine with USB, firewire, etc. drives.
>>
>> My problem is with network shares (through SMB, for example). I
>> never seem to get a notification, so can not update my NTFS<-
>> >Win32 mappings. Is there another way to do this? I can see
>> messages coming up when I access files on the network share (I’ll
>> see something like \Device\Mup\HaliGrid\networkstorage\test
>> \test.txt, for example), so I know my filter has attached, but my
>> instance setup callback never gets called.
>>
>> Searching through the mailing lists, it appears that there are
>> some sort of LAN redirectors, but I haven’t been able to find a
>> good explanation for how this all works.
>>
>> Can someone give me an explanation of what is going on and if
>> there is a way to do what I want?
>>
>> Thanks!
>> Andrew Cheyne
>>
>> PS: Before someone mentions it - yes, I know files can be accessed
>> without a drive being mapped. I’ll handle this eventually… I just
>> want to know that a volume has been mounted on the system!
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks! I’ll take a look at this.
Andrew
On 29-May-08, at 5:45 PM, xxxxx@xythos.com wrote:
Try to register for shell notifications in user mode. It is API
ShChangeNotifyRegister(). Mapping of remote drive should generate
SHCNE_DRIVEADD event. WM_DEVICECHANGE might be also generated, but I
am not sure.
-bg
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Look at IoVolumeDeviceToDosName. I don’t know if it will work for network
mappings.
I prefer doing these conversions in the user application.
Bill Wandel
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
Sent: Friday, May 30, 2008 8:11 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] network volumes
Daniel,
Thanks. I thought as much (one instance of the driver per volume object
for network access) after poking around.
The reason I need the mapping is simply because NTFS paths don’t mean
much to Win32 calls, so when I’m in my user-mode app and need to do
something useful with the files I’m monitoring, I need to convert the path
from the NTFS path structure to a Win32 structure. My current implementation
does this by creating a mapping from NTFS file path to
Win32 file path - is there already an API that will do this for me? It would
make my life a lot easier!
Thanks,
Andrew
On 29-May-08, at 5:01 PM, > wrote:
> All network requests are directed to the same volume object so you
> will not receive instance callbacks for individual shares and I don’t
> think you can manually attach them. I do not understand the problem of
> the file name mapping though, all networks paths have the same syntax,
> then what is the problem in translating them or insisting these are
> updated from an instance callback ?
>
> //Daniel
>
>
> “Andrew Cheyne” wrote in message
> news:xxxxx@ntfsd …
>> Good day,
>>
>> I have a minifilter driver that is monitoring the file system for
>> interesting activity (interesting to a user-mode application). When
>> something of interest happens, an event is sent to a user-mode
>> application.
>>
>> Within the user-mode application, I have created a mapping
>> function that can map the NTFS path into a Win32 style path so the
>> path can be accessed with Win32 calls if need be. (ie: \Device
>> \HarddiskVolume3 <==> D:, for example).
>>
>> To ensure that my map is up to date as external drives, etc. are
>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>> notify the user-process that a new volume has been attached. This all
>> works fine with USB, firewire, etc. drives.
>>
>> My problem is with network shares (through SMB, for example). I
>> never seem to get a notification, so can not update my NTFS<-
>> >Win32 mappings. Is there another way to do this? I can see
>> messages coming up when I access files on the network share (I’ll
>> see something like \Device\Mup\HaliGrid\networkstorage\test
>> \test.txt, for example), so I know my filter has attached, but my
>> instance setup callback never gets called.
>>
>> Searching through the mailing lists, it appears that there are
>> some sort of LAN redirectors, but I haven’t been able to find a good
>> explanation for how this all works.
>>
>> Can someone give me an explanation of what is going on and if
>> there is a way to do what I want?
>>
>> Thanks!
>> Andrew Cheyne
>>
>> PS: Before someone mentions it - yes, I know files can be accessed
>> without a drive being mapped. I’ll handle this eventually… I just
>> want to know that a volume has been mounted on the system!
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars (including our new
> fs mini-filter seminar) visit: http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
unsubscribe send a blank email to xxxxx@lists.osr.com
Bill,
I am doing the conversion in the user application. My driver
passes the NTFS path to the driver and I use my drive mapping
information to convert that into a Win32 path. Is there a client API I
could use to do this directly? I’m not sure that I actually looked for
one and just build my own mapping code directly as I mentioned below.
Thanks!
Andrew
On 30-May-08, at 9:36 AM, Bill Wandel wrote:
Look at IoVolumeDeviceToDosName. I don’t know if it will work for
network
mappings.
I prefer doing these conversions in the user application.
Bill Wandel
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
Sent: Friday, May 30, 2008 8:11 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] network volumes
Daniel,
Thanks. I thought as much (one instance of the driver per volume
object
for network access) after poking around.
The reason I need the mapping is simply because NTFS paths don’t
mean
much to Win32 calls, so when I’m in my user-mode app and need to do
something useful with the files I’m monitoring, I need to convert
the path
from the NTFS path structure to a Win32 structure. My current
implementation
does this by creating a mapping from NTFS file path to
Win32 file path - is there already an API that will do this for me?
It would
make my life a lot easier!
Thanks,
Andrew
On 29-May-08, at 5:01 PM, >> wrote:
>
>> All network requests are directed to the same volume object so you
>> will not receive instance callbacks for individual shares and I don’t
>> think you can manually attach them. I do not understand the problem
>> of
>> the file name mapping though, all networks paths have the same
>> syntax,
>> then what is the problem in translating them or insisting these are
>> updated from an instance callback ?
>>
>> //Daniel
>>
>>
>> “Andrew Cheyne” wrote in message
>> news:xxxxx@ntfsd …
>>> Good day,
>>>
>>> I have a minifilter driver that is monitoring the file system for
>>> interesting activity (interesting to a user-mode application). When
>>> something of interest happens, an event is sent to a user-mode
>>> application.
>>>
>>> Within the user-mode application, I have created a mapping
>>> function that can map the NTFS path into a Win32 style path so the
>>> path can be accessed with Win32 calls if need be. (ie: \Device
>>> \HarddiskVolume3 <==> D:, for example).
>>>
>>> To ensure that my map is up to date as external drives, etc. are
>>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>>> notify the user-process that a new volume has been attached. This
>>> all
>>> works fine with USB, firewire, etc. drives.
>>>
>>> My problem is with network shares (through SMB, for example). I
>>> never seem to get a notification, so can not update my NTFS<-
>>>> Win32 mappings. Is there another way to do this? I can see
>>> messages coming up when I access files on the network share (I’ll
>>> see something like \Device\Mup\HaliGrid\networkstorage\test
>>> \test.txt, for example), so I know my filter has attached, but my
>>> instance setup callback never gets called.
>>>
>>> Searching through the mailing lists, it appears that there are
>>> some sort of LAN redirectors, but I haven’t been able to find a good
>>> explanation for how this all works.
>>>
>>> Can someone give me an explanation of what is going on and if
>>> there is a way to do what I want?
>>>
>>> Thanks!
>>> Andrew Cheyne
>>>
>>> PS: Before someone mentions it - yes, I know files can be accessed
>>> without a drive being mapped. I’ll handle this eventually… I just
>>> want to know that a volume has been mounted on the system!
>>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars (including our
>> new
>> fs mini-filter seminar) visit: http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as:
>> xxxxx@gridironsoftware.com
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars (including our
> new fs
> mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
I have one additional idea. You can use ObQueryNameString and some heuristic to find symbolic link from dos namespace. Following thread might be interesting for you.
http://www.osronline.com/showThread.cfm?link=23125
Good Luck
-bg
QueryDosDevice can return all the current mappings.
Bill Wandel
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
Sent: Friday, May 30, 2008 8:42 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] network volumes
Bill,
I am doing the conversion in the user application. My driver passes the
NTFS path to the driver and I use my drive mapping information to convert
that into a Win32 path. Is there a client API I could use to do this
directly? I’m not sure that I actually looked for one and just build my own
mapping code directly as I mentioned below.
Thanks!
Andrew
On 30-May-08, at 9:36 AM, Bill Wandel wrote:
Look at IoVolumeDeviceToDosName. I don’t know if it will work for
network
mappings.
I prefer doing these conversions in the user application.
Bill Wandel
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
Sent: Friday, May 30, 2008 8:11 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] network volumes
Daniel,
Thanks. I thought as much (one instance of the driver per volume
object
for network access) after poking around.
The reason I need the mapping is simply because NTFS paths don’t
mean
much to Win32 calls, so when I’m in my user-mode app and need to do
something useful with the files I’m monitoring, I need to convert
the path
from the NTFS path structure to a Win32 structure. My current
implementation
does this by creating a mapping from NTFS file path to
Win32 file path - is there already an API that will do this for me?
It would
make my life a lot easier!
Thanks,
Andrew
On 29-May-08, at 5:01 PM,
>> wrote:
>
>> All network requests are directed to the same volume object so you
>> will not receive instance callbacks for individual shares and I don’t
>> think you can manually attach them. I do not understand the problem
>> of
>> the file name mapping though, all networks paths have the same
>> syntax,
>> then what is the problem in translating them or insisting these are
>> updated from an instance callback ?
>>
>> //Daniel
>>
>>
>> “Andrew Cheyne” wrote in message
>> news:xxxxx@ntfsd …
>>> Good day,
>>>
>>> I have a minifilter driver that is monitoring the file system for
>>> interesting activity (interesting to a user-mode application). When
>>> something of interest happens, an event is sent to a user-mode
>>> application.
>>>
>>> Within the user-mode application, I have created a mapping
>>> function that can map the NTFS path into a Win32 style path so the
>>> path can be accessed with Win32 calls if need be. (ie: \Device
>>> \HarddiskVolume3 <==> D:, for example).
>>>
>>> To ensure that my map is up to date as external drives, etc. are
>>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>>> notify the user-process that a new volume has been attached. This
>>> all
>>> works fine with USB, firewire, etc. drives.
>>>
>>> My problem is with network shares (through SMB, for example). I
>>> never seem to get a notification, so can not update my NTFS<-
>>>> Win32 mappings. Is there another way to do this? I can see
>>> messages coming up when I access files on the network share (I’ll
>>> see something like \Device\Mup\HaliGrid\networkstorage\test
>>> \test.txt, for example), so I know my filter has attached, but my
>>> instance setup callback never gets called.
>>>
>>> Searching through the mailing lists, it appears that there are
>>> some sort of LAN redirectors, but I haven’t been able to find a good
>>> explanation for how this all works.
>>>
>>> Can someone give me an explanation of what is going on and if
>>> there is a way to do what I want?
>>>
>>> Thanks!
>>> Andrew Cheyne
>>>
>>> PS: Before someone mentions it - yes, I know files can be accessed
>>> without a drive being mapped. I’ll handle this eventually… I just
>>> want to know that a volume has been mounted on the system!
>>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars (including our
>> new
>> fs mini-filter seminar) visit: http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as:
>> xxxxx@gridironsoftware.com
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars (including our
> new fs
> mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: xxxxx@bwandel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yes, better do this in the user application. Treat network access as a
special case,
so whenever you encounter
\Device\Mup\ or
\Device\LanmanRedirector\
replace that with \ and you’re done.
You can use QueryDosDevice to resolve drive letters to paths with kernel
object syntax.
//Daniel
“Andrew Cheyne” wrote in message
news:xxxxx@ntfsd…
> Bill,
>
> I am doing the conversion in the user application. My driver passes
> the NTFS path to the driver and I use my drive mapping information to
> convert that into a Win32 path. Is there a client API I could use to do
> this directly? I’m not sure that I actually looked for one and just build
> my own mapping code directly as I mentioned below.
>
> Thanks!
> Andrew
>
> On 30-May-08, at 9:36 AM, Bill Wandel wrote:
>
>> Look at IoVolumeDeviceToDosName. I don’t know if it will work for
>> network
>> mappings.
>> I prefer doing these conversions in the user application.
>>
>> Bill Wandel
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
>> Sent: Friday, May 30, 2008 8:11 AM
>> To: Windows File Systems Devs Interest List
>> Subject: Re: [ntfsd] network volumes
>>
>> Daniel,
>>
>> Thanks. I thought as much (one instance of the driver per volume
>> object
>> for network access) after poking around.
>>
>> The reason I need the mapping is simply because NTFS paths don’t
>> mean
>> much to Win32 calls, so when I’m in my user-mode app and need to do
>> something useful with the files I’m monitoring, I need to convert the
>> path
>> from the NTFS path structure to a Win32 structure. My current
>> implementation
>> does this by creating a mapping from NTFS file path to
>> Win32 file path - is there already an API that will do this for me? It
>> would
>> make my life a lot easier!
>>
>> Thanks,
>> Andrew
>>
>> On 29-May-08, at 5:01 PM,
>> >>> wrote:
>>
>>> All network requests are directed to the same volume object so you
>>> will not receive instance callbacks for individual shares and I don’t
>>> think you can manually attach them. I do not understand the problem of
>>> the file name mapping though, all networks paths have the same syntax,
>>> then what is the problem in translating them or insisting these are
>>> updated from an instance callback ?
>>>
>>> //Daniel
>>>
>>>
>>> “Andrew Cheyne” wrote in message
>>> news:xxxxx@ntfsd …
>>>> Good day,
>>>>
>>>> I have a minifilter driver that is monitoring the file system for
>>>> interesting activity (interesting to a user-mode application). When
>>>> something of interest happens, an event is sent to a user-mode
>>>> application.
>>>>
>>>> Within the user-mode application, I have created a mapping
>>>> function that can map the NTFS path into a Win32 style path so the
>>>> path can be accessed with Win32 calls if need be. (ie: \Device
>>>> \HarddiskVolume3 <==> D:, for example).
>>>>
>>>> To ensure that my map is up to date as external drives, etc. are
>>>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>>>> notify the user-process that a new volume has been attached. This all
>>>> works fine with USB, firewire, etc. drives.
>>>>
>>>> My problem is with network shares (through SMB, for example). I
>>>> never seem to get a notification, so can not update my NTFS<-
>>>>> Win32 mappings. Is there another way to do this? I can see
>>>> messages coming up when I access files on the network share (I’ll
>>>> see something like \Device\Mup\HaliGrid\networkstorage\test
>>>> \test.txt, for example), so I know my filter has attached, but my
>>>> instance setup callback never gets called.
>>>>
>>>> Searching through the mailing lists, it appears that there are
>>>> some sort of LAN redirectors, but I haven’t been able to find a good
>>>> explanation for how this all works.
>>>>
>>>> Can someone give me an explanation of what is going on and if
>>>> there is a way to do what I want?
>>>>
>>>> Thanks!
>>>> Andrew Cheyne
>>>>
>>>> PS: Before someone mentions it - yes, I know files can be accessed
>>>> without a drive being mapped. I’ll handle this eventually… I just
>>>> want to know that a volume has been mounted on the system!
>>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> For our schedule debugging and file system seminars (including our new
>>> fs mini-filter seminar) visit: http://www.osr.com/seminars
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars (including our new
>> fs
>> mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
>> unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
Daniel,
Hmm, interesting. Are \Device\Mup\ and \Device\LanmanRedirector\
the only possible values I would have to worry about?
Thanks,
Andrew
On 30-May-08, at 9:54 AM, > wrote:
> Yes, better do this in the user application. Treat network access
> as a special case,
> so whenever you encounter
>
> \Device\Mup\ or
> \Device\LanmanRedirector<br>>
> replace that with \ and you’re done.
>
> You can use QueryDosDevice to resolve drive letters to paths with
> kernel object syntax.
>
> //Daniel
>
>
>
> “Andrew Cheyne” wrote in message news:xxxxx@ntfsd
> …
>> Bill,
>>
>> I am doing the conversion in the user application. My driver
>> passes the NTFS path to the driver and I use my drive mapping
>> information to convert that into a Win32 path. Is there a client
>> API I could use to do this directly? I’m not sure that I actually
>> looked for one and just build my own mapping code directly as I
>> mentioned below.
>>
>> Thanks!
>> Andrew
>>
>> On 30-May-08, at 9:36 AM, Bill Wandel wrote:
>>
>>> Look at IoVolumeDeviceToDosName. I don’t know if it will work for
>>> network
>>> mappings.
>>> I prefer doing these conversions in the user application.
>>>
>>> Bill Wandel
>>>
>>>
>>> -----Original Message-----
>>> From: xxxxx@lists.osr.com
>>> [mailto:xxxxx@lists.osr.com] On Behalf Of Andrew
>>> Cheyne
>>> Sent: Friday, May 30, 2008 8:11 AM
>>> To: Windows File Systems Devs Interest List
>>> Subject: Re: [ntfsd] network volumes
>>>
>>> Daniel,
>>>
>>> Thanks. I thought as much (one instance of the driver per
>>> volume object
>>> for network access) after poking around.
>>>
>>> The reason I need the mapping is simply because NTFS paths
>>> don’t mean
>>> much to Win32 calls, so when I’m in my user-mode app and need to do
>>> something useful with the files I’m monitoring, I need to convert
>>> the path
>>> from the NTFS path structure to a Win32 structure. My current
>>> implementation
>>> does this by creating a mapping from NTFS file path to
>>> Win32 file path - is there already an API that will do this for
>>> me? It would
>>> make my life a lot easier!
>>>
>>> Thanks,
>>> Andrew
>>>
>>> On 29-May-08, at 5:01 PM, >>>> wrote:
>>>
>>>> All network requests are directed to the same volume object so you
>>>> will not receive instance callbacks for individual shares and I
>>>> don’t
>>>> think you can manually attach them. I do not understand the
>>>> problem of
>>>> the file name mapping though, all networks paths have the same
>>>> syntax,
>>>> then what is the problem in translating them or insisting these are
>>>> updated from an instance callback ?
>>>>
>>>> //Daniel
>>>>
>>>>
>>>> “Andrew Cheyne” wrote in message
>>>> news:xxxxx@ntfsd …
>>>>> Good day,
>>>>>
>>>>> I have a minifilter driver that is monitoring the file system for
>>>>> interesting activity (interesting to a user-mode application).
>>>>> When
>>>>> something of interest happens, an event is sent to a user-mode
>>>>> application.
>>>>>
>>>>> Within the user-mode application, I have created a mapping
>>>>> function that can map the NTFS path into a Win32 style path so the
>>>>> path can be accessed with Win32 calls if need be. (ie: \Device
>>>>> \HarddiskVolume3 <==> D:, for example).
>>>>>
>>>>> To ensure that my map is up to date as external drives, etc. are
>>>>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>>>>> notify the user-process that a new volume has been attached.
>>>>> This all
>>>>> works fine with USB, firewire, etc. drives.
>>>>>
>>>>> My problem is with network shares (through SMB, for example). I
>>>>> never seem to get a notification, so can not update my NTFS<-
>>>>>> Win32 mappings. Is there another way to do this? I can see
>>>>> messages coming up when I access files on the network share (I’ll
>>>>> see something like \Device\Mup\HaliGrid\networkstorage\test
>>>>> \test.txt, for example), so I know my filter has attached, but my
>>>>> instance setup callback never gets called.
>>>>>
>>>>> Searching through the mailing lists, it appears that there are
>>>>> some sort of LAN redirectors, but I haven’t been able to find a
>>>>> good
>>>>> explanation for how this all works.
>>>>>
>>>>> Can someone give me an explanation of what is going on and if
>>>>> there is a way to do what I want?
>>>>>
>>>>> Thanks!
>>>>> Andrew Cheyne
>>>>>
>>>>> PS: Before someone mentions it - yes, I know files can be accessed
>>>>> without a drive being mapped. I’ll handle this eventually… I just
>>>>> want to know that a volume has been mounted on the system!
>>>>>
>>>>
>>>> —
>>>> NTFSD is sponsored by OSR
>>>>
>>>> For our schedule debugging and file system seminars (including
>>>> our new
>>>> fs mini-filter seminar) visit: http://www.osr.com/seminars
>>>>
>>>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> For our schedule debugging and file system seminars (including
>>> our new fs
>>> mini-filter seminar) visit:
>>> http://www.osr.com/seminars
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
>>> unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> For our schedule debugging and file system seminars
>>> (including our new fs mini-filter seminar) visit:
>>> http://www.osr.com/seminars
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Regarding network shares, I suppose so. However for local volumes there are
other types of symbolic links such as \SystemRoot and \Windows which
ultimately do not get resolved to their target name before you receive them
so you will also need to do the conversion.
//Daniel
“Andrew Cheyne” wrote in message
news:xxxxx@ntfsd…
> Daniel,
>
> Hmm, interesting. Are \Device\Mup\ and \Device\LanmanRedirector\ the
> only possible values I would have to worry about?
>
> Thanks,
> Andrew
>
> On 30-May-08, at 9:54 AM,
> > > wrote:
>
>> Yes, better do this in the user application. Treat network access as a
>> special case,
>> so whenever you encounter
>>
>> \Device\Mup\ or
>> \Device\LanmanRedirector<br>>>
>> replace that with \ and you’re done.
>>
>> You can use QueryDosDevice to resolve drive letters to paths with kernel
>> object syntax.
>>
>> //Daniel
>>
>>
>>
>> “Andrew Cheyne” wrote in message
>> news:xxxxx@ntfsd …
>>> Bill,
>>>
>>> I am doing the conversion in the user application. My driver passes
>>> the NTFS path to the driver and I use my drive mapping information to
>>> convert that into a Win32 path. Is there a client API I could use to
>>> do this directly? I’m not sure that I actually looked for one and just
>>> build my own mapping code directly as I mentioned below.
>>>
>>> Thanks!
>>> Andrew
>>>
>>> On 30-May-08, at 9:36 AM, Bill Wandel wrote:
>>>
>>>> Look at IoVolumeDeviceToDosName. I don’t know if it will work for
>>>> network
>>>> mappings.
>>>> I prefer doing these conversions in the user application.
>>>>
>>>> Bill Wandel
>>>>
>>>>
>>>> -----Original Message-----
>>>> From: xxxxx@lists.osr.com
>>>> [mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Cheyne
>>>> Sent: Friday, May 30, 2008 8:11 AM
>>>> To: Windows File Systems Devs Interest List
>>>> Subject: Re: [ntfsd] network volumes
>>>>
>>>> Daniel,
>>>>
>>>> Thanks. I thought as much (one instance of the driver per volume
>>>> object
>>>> for network access) after poking around.
>>>>
>>>> The reason I need the mapping is simply because NTFS paths don’t
>>>> mean
>>>> much to Win32 calls, so when I’m in my user-mode app and need to do
>>>> something useful with the files I’m monitoring, I need to convert the
>>>> path
>>>> from the NTFS path structure to a Win32 structure. My current
>>>> implementation
>>>> does this by creating a mapping from NTFS file path to
>>>> Win32 file path - is there already an API that will do this for me?
>>>> It would
>>>> make my life a lot easier!
>>>>
>>>> Thanks,
>>>> Andrew
>>>>
>>>> On 29-May-08, at 5:01 PM,
>>>> >>>>> wrote:
>>>>
>>>>> All network requests are directed to the same volume object so you
>>>>> will not receive instance callbacks for individual shares and I don’t
>>>>> think you can manually attach them. I do not understand the problem
>>>>> of
>>>>> the file name mapping though, all networks paths have the same
>>>>> syntax,
>>>>> then what is the problem in translating them or insisting these are
>>>>> updated from an instance callback ?
>>>>>
>>>>> //Daniel
>>>>>
>>>>>
>>>>> “Andrew Cheyne” wrote in message
>>>>> news:xxxxx@ntfsd …
>>>>>> Good day,
>>>>>>
>>>>>> I have a minifilter driver that is monitoring the file system for
>>>>>> interesting activity (interesting to a user-mode application). When
>>>>>> something of interest happens, an event is sent to a user-mode
>>>>>> application.
>>>>>>
>>>>>> Within the user-mode application, I have created a mapping
>>>>>> function that can map the NTFS path into a Win32 style path so the
>>>>>> path can be accessed with Win32 calls if need be. (ie: \Device
>>>>>> \HarddiskVolume3 <==> D:, for example).
>>>>>>
>>>>>> To ensure that my map is up to date as external drives, etc. are
>>>>>> attached to the system, I use the PFLT_INSTANCE_SETUP_CALLBACK to
>>>>>> notify the user-process that a new volume has been attached. This
>>>>>> all
>>>>>> works fine with USB, firewire, etc. drives.
>>>>>>
>>>>>> My problem is with network shares (through SMB, for example). I
>>>>>> never seem to get a notification, so can not update my NTFS<-
>>>>>>> Win32 mappings. Is there another way to do this? I can see
>>>>>> messages coming up when I access files on the network share (I’ll
>>>>>> see something like \Device\Mup\HaliGrid\networkstorage\test
>>>>>> \test.txt, for example), so I know my filter has attached, but my
>>>>>> instance setup callback never gets called.
>>>>>>
>>>>>> Searching through the mailing lists, it appears that there are
>>>>>> some sort of LAN redirectors, but I haven’t been able to find a good
>>>>>> explanation for how this all works.
>>>>>>
>>>>>> Can someone give me an explanation of what is going on and if
>>>>>> there is a way to do what I want?
>>>>>>
>>>>>> Thanks!
>>>>>> Andrew Cheyne
>>>>>>
>>>>>> PS: Before someone mentions it - yes, I know files can be accessed
>>>>>> without a drive being mapped. I’ll handle this eventually… I just
>>>>>> want to know that a volume has been mounted on the system!
>>>>>>
>>>>>
>>>>> —
>>>>> NTFSD is sponsored by OSR
>>>>>
>>>>> For our schedule debugging and file system seminars (including our
>>>>> new
>>>>> fs mini-filter seminar) visit: http://www.osr.com/seminars
>>>>>
>>>>> You are currently subscribed to ntfsd as:
>>>>> xxxxx@gridironsoftware.com
>>>>> To unsubscribe send a blank email to
>>>>> xxxxx@lists.osr.com
>>>>
>>>>
>>>> —
>>>> NTFSD is sponsored by OSR
>>>>
>>>> For our schedule debugging and file system seminars (including our
>>>> new fs
>>>> mini-filter seminar) visit:
>>>> http://www.osr.com/seminars
>>>>
>>>> You are currently subscribed to ntfsd as: xxxxx@bwandel.com To
>>>> unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>>
>>>> —
>>>> NTFSD is sponsored by OSR
>>>>
>>>> For our schedule debugging and file system seminars
>>>> (including our new fs mini-filter seminar) visit:
>>>> http://www.osr.com/seminars
>>>>
>>>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@gridironsoftware.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> Hmm, interesting. Are \Device\Mup\ and \Device\LanmanRedirector\
the only possible values I would have to worry about?
It is more difficult. Network mappings are done in logon session namespace of given user.
So for example symbolic link for drive I: can be something like \Device\LanmanRedirector;I:\server\share[\path] on XP. On vista ‘\device\LanmanRedirector’ is symbolic link to \DeviceMup;LanManRedirector.
Use sysinternals’s WinObj tool for exploring Obj Manager namespace. Logon session namespaces are under \Sessions. Skywing wrote nice series of articles about object manager (http://www.nynaeve.net/).
-bg
wrote in message news:xxxxx@ntfsd…
>> Hmm, interesting. Are \Device\Mup\ and \Device\LanmanRedirector<br>>> the only possible values I would have to worry about?
>
> It is more difficult. Network mappings are done in logon session namespace
> of given user.
>
> So for example symbolic link for drive I: can be something like
> \Device\LanmanRedirector;I:\server\share[\path] on XP.
> On vista ‘\device\LanmanRedirector’ is symbolic link to
> \DeviceMup;LanManRedirector.
>
That’s true but from what I’ve seen so far, at least for minifilters these
names will have been translated to their final targets by the time you
receive them so they are not of immediate concern. However this is not true
for certain other local symbolic links so I suppose any such undertaking can
be only s a best effort approach.
//Daniel