Opening a file during IRP_MJ_WRITE

NTFSD
1

In my filter driver, the 1st time I’m notified that a file is being written
during IRP_MJ_WRITE I would like to capture the contents before the IRP is
processed. To this end, I’m trying to open that file for reading, suck up
the contents, close the file, and then allow the Write to complete.

I’ve tried 2 approaches so far, and both fail. One is with
ObOpenObjectByPointer. When I do this the open hangs in
KeWaitForSingleEvent.

Status = ObOpenObjectByPointer(irpSp->FileObject,OBJ_KERNEL_HANDLE,
(PACCESS_STATE) NULL,
FILE_READ_DATA,
*IoFileObjectType,
KernelMode,
&FileHandle);

The 2nd approach was to open the file using
IoCreateFileSpecifyDeviceObjectHint , this failed when I tried to close the
file, again hanging in KeWaitForSingleObject

InitializeObjectAttributes(&ObjAttrs,
&FullPathName,OBJ_OPENIF|OBJ_KERNEL_HANDLE,NULL,NULL);

Status = IoCreateFileSpecifyDeviceObjectHint(&FileHandle,
GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA|READ_CONTROL,
&ObjAttrs,
&StatusBlock,
0, //allocation size
FILE_ATTRIBUTE_NORMAL,
0, //share access
FILE_OPEN_IF, // disposition
FILE_NON_DIRECTORY_FILE, // CreateOptions,
0, // EaBuffer OPTIONAL,
0 , // EaLength
CreateFileTypeNone, // CreateFileType
NULL, // extra params
IO_IGNORE_SHARE_ACCESS_CHECK, // Options
pFADevExt->AttachedToDeviceObject
);

Is there something wrong in these attempts, i.e. one of zillion different
permutations of the flags?

Or is the approach fundamentally flawed?

Thanks

Larry

2

I suggest that you roll your own read IRPs and get the
file contents instead of your current approach.

Regards,
Razvan

— Larry wrote:
> In my filter driver, the 1st time I’m notified that
> a file is being written
> during IRP_MJ_WRITE I would like to capture the
> contents before the IRP is
> processed. To this end, I’m trying to open that
> file for reading, suck up
> the contents, close the file, and then allow the
> Write to complete.
>
> I’ve tried 2 approaches so far, and both fail. One
> is with
> ObOpenObjectByPointer. When I do this the open hangs
> in
> KeWaitForSingleEvent.
>
> Status =
>
ObOpenObjectByPointer(irpSp->FileObject,OBJ_KERNEL_HANDLE,
> (PACCESS_STATE) NULL,
> FILE_READ_DATA,
> *IoFileObjectType,
> KernelMode,
> &FileHandle);
>
>
> The 2nd approach was to open the file using
> IoCreateFileSpecifyDeviceObjectHint , this failed
> when I tried to close the
> file, again hanging in KeWaitForSingleObject
>
> InitializeObjectAttributes(&ObjAttrs,
>
&FullPathName,OBJ_OPENIF|OBJ_KERNEL_HANDLE,NULL,NULL);
>
>
> Status =
> IoCreateFileSpecifyDeviceObjectHint(&FileHandle,
>
GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA|READ_CONTROL,
> &ObjAttrs,
> &StatusBlock,
> 0, //allocation size
> FILE_ATTRIBUTE_NORMAL,
> 0, //share access
> FILE_OPEN_IF, // disposition
> FILE_NON_DIRECTORY_FILE, // CreateOptions,
> 0, // EaBuffer OPTIONAL,
> 0 , // EaLength
> CreateFileTypeNone, // CreateFileType
> NULL, // extra params
> IO_IGNORE_SHARE_ACCESS_CHECK, // Options
> pFADevExt->AttachedToDeviceObject
> );
>
> Is there something wrong in these attempts, i.e. one
> of zillion different
> permutations of the flags?
>
> Or is the approach fundamentally flawed?
>
> Thanks
>
> Larry
>

__________________________________
Do you Yahoo!?
Make Yahoo! your home page
http://www.yahoo.com/r/hs

3

You can’t open file in a context of Paging IO.
A possible work around is to open file in a separate thread (workitem) at
least in case when IRP_MJ_WRITE has IRP_PAGING_IO flag set.

Alexei.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Larry
Sent: Monday, May 09, 2005 9:53 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Opening a file during IRP_MJ_WRITE

In my filter driver, the 1st time I’m notified that a file is being written
during IRP_MJ_WRITE I would like to capture the contents before the IRP is
processed. To this end, I’m trying to open that file for reading, suck up
the contents, close the file, and then allow the Write to complete.

I’ve tried 2 approaches so far, and both fail. One is with
ObOpenObjectByPointer. When I do this the open hangs in
KeWaitForSingleEvent.

Status = ObOpenObjectByPointer(irpSp->FileObject,OBJ_KERNEL_HANDLE,
(PACCESS_STATE) NULL,
FILE_READ_DATA,
*IoFileObjectType,
KernelMode,
&FileHandle);

The 2nd approach was to open the file using
IoCreateFileSpecifyDeviceObjectHint , this failed when I tried to close the
file, again hanging in KeWaitForSingleObject

InitializeObjectAttributes(&ObjAttrs,
&FullPathName,OBJ_OPENIF|OBJ_KERNEL_HANDLE,NULL,NULL);

Status = IoCreateFileSpecifyDeviceObjectHint(&FileHandle,
GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA|READ_CONTROL,
&ObjAttrs,
&StatusBlock,
0, //allocation size
FILE_ATTRIBUTE_NORMAL,
0, //share access
FILE_OPEN_IF, // disposition
FILE_NON_DIRECTORY_FILE, // CreateOptions,
0, // EaBuffer OPTIONAL,
0 , // EaLength
CreateFileTypeNone, // CreateFileType
NULL, // extra params
IO_IGNORE_SHARE_ACCESS_CHECK, // Options
pFADevExt->AttachedToDeviceObject
);

Is there something wrong in these attempts, i.e. one of zillion different
permutations of the flags?

Or is the approach fundamentally flawed?

Thanks

Larry

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@vmware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Why?
Why IRP_MJ_WRITE but not the FastIoWrite functions?
You can I suppose roll-your-own IRP_MJ_READ against the FILE_OBJECT from the
IRP_MJ_WRITE to slurp the file.
If you are in page write path then be careful …
If you are in modified page writer path then be very careful …

“Larry” wrote in message news:xxxxx@ntfsd…
> In my filter driver, the 1st time I’m notified that a file is being
> written
> during IRP_MJ_WRITE I would like to capture the contents before the IRP is
> processed. To this end, I’m trying to open that file for reading, suck up
> the contents, close the file, and then allow the Write to complete.
>
> I’ve tried 2 approaches so far, and both fail. One is with
> ObOpenObjectByPointer. When I do this the open hangs in
> KeWaitForSingleEvent.
>
> Status = ObOpenObjectByPointer(irpSp->FileObject,OBJ_KERNEL_HANDLE,
> (PACCESS_STATE) NULL,
> FILE_READ_DATA,
> *IoFileObjectType,
> KernelMode,
> &FileHandle);
>
>
> The 2nd approach was to open the file using
> IoCreateFileSpecifyDeviceObjectHint , this failed when I tried to close
> the
> file, again hanging in KeWaitForSingleObject
>
> InitializeObjectAttributes(&ObjAttrs,
> &FullPathName,OBJ_OPENIF|OBJ_KERNEL_HANDLE,NULL,NULL);
>
>
> Status = IoCreateFileSpecifyDeviceObjectHint(&FileHandle,
> GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA|READ_CONTROL,
> &ObjAttrs,
> &StatusBlock,
> 0, //allocation size
> FILE_ATTRIBUTE_NORMAL,
> 0, //share access
> FILE_OPEN_IF, // disposition
> FILE_NON_DIRECTORY_FILE, // CreateOptions,
> 0, // EaBuffer OPTIONAL,
> 0 , // EaLength
> CreateFileTypeNone, // CreateFileType
> NULL, // extra params
> IO_IGNORE_SHARE_ACCESS_CHECK, // Options
> pFADevExt->AttachedToDeviceObject
> );
>
> Is there something wrong in these attempts, i.e. one of zillion different
> permutations of the flags?
>
> Or is the approach fundamentally flawed?
>
> Thanks
>
> Larry
>
>
>
>
>