Newbie minifilter query re closing a file

Hi,

I’m new to Windows filter drivers and am currently writing a filesystem minifilter driver. The minifilter intercepts IRP_MJ_CREATE operations which open certain data files on a particular volume, and changes the TargetInstance to send the operation to a removable disk volume. This allows the latest data files on the removable disk to always be read. However, if the removable disk is removed, I want the running programs to be unaware of the removal, and for subsequent reads to access the originally-intended files on the original target volume.

My question is how to handle operations such as IRP_MJ_PNP operations which indicate the removable disk is about to be, or has been, removed. I need to close the files that have been opened on the removable disk (i.e. that were opened because the original CREATE request was re-routed to the removable volume) and then I’ll use FltCreateFileEx() to open the “original” files and send all subsequent reads to the original files.

However, I don’t know how to close the currently-open files on the removable disk. I can’t use FltClose() or ZwClose() because I don’t have a handle for the open files. I don’t think I can use ObOpenObjectByPointer() to get a handle because it appears this will increment the open file’s reference count so that “yet another” process will have the file open.

My next thought was to use FltAllocateCallbackData() and FltPerformSynchronousIo() to create and perform a dummy IRP_MJ_CLEANUP and IRP_MJ_CLOSE. However, these seem to need a valid Thread pointer (and possibly other items), which I don’t have.

Can someone suggest how I should proceed?

I have a couple of thoughts:

  1. Can I re-use the original Thread pointer, etc, used in the original IRP_MJ_CREATE, when creating and performing dummy IRP_MJ_CLEANUP and CLOSE operations?

  2. Maybe I should not simply re-route the original IRP_MJ_CREATE request, but when I receive one, I should use FltCreateFileEx() to open the appropriate file on the removable volume. I’ll then have access to a file handle and fileobject, etc, in the minifilter that I can use to re-route or perform any subsequent operation (read, write, close, etc).

Thanks for any and all advice…

Regards,

David

You can’t transparently replace the file a user is handling in the way
you indicated you wanted to do. Your suggestion # 2 would be a more
reasonable approach to the problem (essentially, you then receive the
I/O and send it to this removable device transparently to the user.)
Then if the device disappears you can handle that in your driver
transparently.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@optushome.com.au
Sent: Friday, July 28, 2006 1:26 AM
To: ntfsd redirect
Subject: [ntfsd] Newbie minifilter query re closing a file

Hi,

I’m new to Windows filter drivers and am currently writing a filesystem
minifilter driver. The minifilter intercepts IRP_MJ_CREATE operations
which open certain data files on a particular volume, and changes the
TargetInstance to send the operation to a removable disk volume. This
allows the latest data files on the removable disk to always be read.
However, if the removable disk is removed, I want the running programs
to be unaware of the removal, and for subsequent reads to access the
originally-intended files on the original target volume.

My question is how to handle operations such as IRP_MJ_PNP operations
which indicate the removable disk is about to be, or has been, removed.
I need to close the files that have been opened on the removable disk
(i.e. that were opened because the original CREATE request was re-routed
to the removable volume) and then I’ll use FltCreateFileEx() to open the
“original” files and send all subsequent reads to the original files.

However, I don’t know how to close the currently-open files on the
removable disk. I can’t use FltClose() or ZwClose() because I don’t have
a handle for the open files. I don’t think I can use
ObOpenObjectByPointer() to get a handle because it appears this will
increment the open file’s reference count so that “yet another” process
will have the file open.

My next thought was to use FltAllocateCallbackData() and
FltPerformSynchronousIo() to create and perform a dummy IRP_MJ_CLEANUP
and IRP_MJ_CLOSE. However, these seem to need a valid Thread pointer
(and possibly other items), which I don’t have.

Can someone suggest how I should proceed?

I have a couple of thoughts:

  1. Can I re-use the original Thread pointer, etc, used in the original
    IRP_MJ_CREATE, when creating and performing dummy IRP_MJ_CLEANUP and
    CLOSE operations?

  2. Maybe I should not simply re-route the original IRP_MJ_CREATE
    request, but when I receive one, I should use FltCreateFileEx() to open
    the appropriate file on the removable volume. I’ll then have access to a
    file handle and fileobject, etc, in the minifilter that I can use to
    re-route or perform any subsequent operation (read, write, close, etc).

Thanks for any and all advice…

Regards,

David


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks Tony - will do.

Regards,

David