Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE

NTFSD
1

Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE

handling.
I have developed my filter.it’s below NAV.
Oh,I will make my IRP_MJ_CREATE,OK,it’s a recursive

IRP_MJ_CREATE.
NAV received my IRP_MJ_CREATE,but he will IGNORE it!!!
And,even if I Send an IRP_MJ_CREATE for different

filename from original IRP_MJ_CREATE.
NAV also will IGNORE it.
IGNORE,my means is that NAV will not scan this file.
Normally,NAV will scan the file because of the

IRP_MJ_CREATE.

God.I think NAV perhaps use a tech that will detected

this is a recursive IRP_MJ_CREATE.
So,this IRP_MJ_CREATE must be from other filter. NAV will

ignore it.
Of course,my minds is so simply.

anybody call tell me the secret about that tech?Or the tech NAV used.thank
you very much.I need it.Thank you!

2

I suspect NAV is checking process context. Your filter is using the same
process context that NAV service is using, so NAV things it is one of its
own recursive calls.

One solution is to make a service and have its process context handle your
create calls.

Jamey Kirby, Windows DDK MVP
StorageCraft Inc.
xxxxx@storagecraft.com
http://www.storagecraft.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ecore
Sent: Saturday, September 13, 2003 4:24 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE

Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE

handling.
I have developed my filter.it’s below NAV.
Oh,I will make my IRP_MJ_CREATE,OK,it’s a recursive

IRP_MJ_CREATE.
NAV received my IRP_MJ_CREATE,but he will IGNORE it!!!
And,even if I Send an IRP_MJ_CREATE for different

filename from original IRP_MJ_CREATE.
NAV also will IGNORE it.
IGNORE,my means is that NAV will not scan this file.
Normally,NAV will scan the file because of the

IRP_MJ_CREATE.

God.I think NAV perhaps use a tech that will detected

this is a recursive IRP_MJ_CREATE.
So,this IRP_MJ_CREATE must be from other filter. NAV will

ignore it.
Of course,my minds is so simply.

anybody call tell me the secret about that tech?Or the tech NAV used.thank
you very much.I need it.Thank you!

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

It seems like you are below NAV and you send an IRP_MJ_CREATE to the
driver below your filter. In this case, of course NAV won’t see it, it’s
above both of you in the stack. In theory, if you’re a filter that
unmangles data you want the A/V products to be below you, but you can’t
guarantee this with today’s filter model. Microsoft will be doing
something about this soon, however.

ecore wrote:

Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE

handling.
I have developed my filter.it’s below NAV.
Oh,I will make my IRP_MJ_CREATE,OK,it’s a recursive

IRP_MJ_CREATE.
NAV received my IRP_MJ_CREATE,but he will IGNORE it!!!
And,even if I Send an IRP_MJ_CREATE for different

filename from original IRP_MJ_CREATE.
NAV also will IGNORE it.
IGNORE,my means is that NAV will not scan this file.
Normally,NAV will scan the file because of the

IRP_MJ_CREATE.

God.I think NAV perhaps use a tech that will detected

this is a recursive IRP_MJ_CREATE.
So,this IRP_MJ_CREATE must be from other filter. NAV will

ignore it.
Of course,my minds is so simply.

anybody call tell me the secret about that tech?Or the tech NAV used.thank
you very much.I need it.Thank you!

–
Nick Ryan (MVP for DDK)

4

sorry for my simple description.
1.I Make my IRP_MJ_CREATE at SystemThread.So,I’m not at NAV’s process
context.
2.I just use ZwCreateFile.so,NAV will see this IRP_MJ_CREATE.
OK,I can’t believe NAV can do that.It will ignore my IRP_MJ_CREATE,as if
it know it will lead to recursive,and then deadlock.
Perfect Filter.Can’t believe.But it does do!
You may test it,observe it.

It seems like you are below NAV and you send an IRP_MJ_CREATE to the
driver below your filter. In this case, of course NAV won’t see it, it’s
above both of you in the stack. In theory, if you’re a filter that
unmangles data you want the A/V products to be below you, but you can’t
guarantee this with today’s filter model. Microsoft will be doing
something about this soon, however.

ecore wrote:

> Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE
>
> handling.
> I have developed my filter.it’s below NAV.
> Oh,I will make my IRP_MJ_CREATE,OK,it’s a recursive
>
> IRP_MJ_CREATE.
> NAV received my IRP_MJ_CREATE,but he will IGNORE it!!!
> And,even if I Send an IRP_MJ_CREATE for different
>
> filename from original IRP_MJ_CREATE.
> NAV also will IGNORE it.
> IGNORE,my means is that NAV will not scan this file.
> Normally,NAV will scan the file because of the
>
> IRP_MJ_CREATE.
>
> God.I think NAV perhaps use a tech that will detected
>
> this is a recursive IRP_MJ_CREATE.
> So,this IRP_MJ_CREATE must be from other filter. NAV will
>
> ignore it.
> Of course,my minds is so simply.
>
> anybody call tell me the secret about that tech?Or the tech NAV used.thank
> you very much.I need it.Thank you!
>
>

–
Nick Ryan (MVP for DDK)

5

OK.very simple.
because NAV will ignore Ring0 CreateFile.
eh,so simple cause.
but,not I need.

sorry for my simple description.
1.I Make my IRP_MJ_CREATE at SystemThread.So,I’m not at NAV’s process
context.
2.I just use ZwCreateFile.so,NAV will see this IRP_MJ_CREATE.
OK,I can’t believe NAV can do that.It will ignore my IRP_MJ_CREATE,as if
it know it will lead to recursive,and then deadlock.
Perfect Filter.Can’t believe.But it does do!
You may test it,observe it.

> It seems like you are below NAV and you send an IRP_MJ_CREATE to the
> driver below your filter. In this case, of course NAV won’t see it, it’s
> above both of you in the stack. In theory, if you’re a filter that
> unmangles data you want the A/V products to be below you, but you can’t
> guarantee this with today’s filter model. Microsoft will be doing
> something about this soon, however.
>
> ecore wrote:
>
> > Perfect Filter,NAV.Come in,discuess its IRP_MJ_CREATE
> >
> > handling.
> > I have developed my filter.it’s below NAV.
> > Oh,I will make my IRP_MJ_CREATE,OK,it’s a recursive
> >
> > IRP_MJ_CREATE.
> > NAV received my IRP_MJ_CREATE,but he will IGNORE it!!!
> > And,even if I Send an IRP_MJ_CREATE for different
> >
> > filename from original IRP_MJ_CREATE.
> > NAV also will IGNORE it.
> > IGNORE,my means is that NAV will not scan this file.
> > Normally,NAV will scan the file because of the
> >
> > IRP_MJ_CREATE.
> >
> > God.I think NAV perhaps use a tech that will detected
> >
> > this is a recursive IRP_MJ_CREATE.
> > So,this IRP_MJ_CREATE must be from other filter. NAV will
> >
> > ignore it.
> > Of course,my minds is so simply.
> >
> > anybody call tell me the secret about that tech?Or the tech NAV used.thank
> > you very much.I need it.Thank you!
> >
> >
>
> –
> Nick Ryan (MVP for DDK)