Process Name for IRP_MJ_READ and IRP_MJ_WRITE

NTFSD
1

Hi All,
I need a help to trace the owner of the Call ( Process Name ). During the
IRP_MJ_READ and IRP_MJ_WRITE.
I have used,

PEPROCESS curproc = PsGetCurrentProcess();

But Here I am Facing Strange Problem. When POWERPOINT is Writing Data in
.ppt File I get some time EXCEL as a Process Name.
Both the Application are Opened and I am Working on them Simultaneously.

Regards,
Utkarsh S. Dabhade

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

2

Yes, sometimes OLE (embedded documents) works this way.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Utkarsh DABHADE”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, June 16, 2005 4:49 PM
Subject: [ntfsd] Process Name for IRP_MJ_READ and IRP_MJ_WRITE

>
>
>
> Hi All,
> I need a help to trace the owner of the Call ( Process Name ). During the
> IRP_MJ_READ and IRP_MJ_WRITE.
> I have used,
>
> PEPROCESS curproc = PsGetCurrentProcess();
>
> But Here I am Facing Strange Problem. When POWERPOINT is Writing Data in
> .ppt File I get some time EXCEL as a Process Name.
> Both the Application are Opened and I am Working on them Simultaneously.
>
> Regards,
> Utkarsh S. Dabhade
>
>
> *
> Disclaimer:
> The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone other
than the intended addressee(s). In case you are not the desired addressee,
you should delete this message and/or re-direct it to the sender. The views
expressed in this E-mail message (including the enclosure(s) or attachment(s)
if any) are those of the individual sender, except where the sender expressly,
and with authority, states them to be the views of MBT.
>
> This e-mail message including attachment/(s), if any, is believed to be free
of any virus. However, it is the responsibility of the recipient to ensure
that it is virus free and MBT is not responsible for any loss or damage arising
in any way from its use
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks Maxim,
But is there any way where I can relate exact process name for Read Write
Operation.

Regards,
Utkarsh S. Dabhade

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Saturday, June 18, 2005 4:25 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Process Name for IRP_MJ_READ and IRP_MJ_WRITE

Yes, sometimes OLE (embedded documents) works this way.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Utkarsh DABHADE”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, June 16, 2005 4:49 PM
Subject: [ntfsd] Process Name for IRP_MJ_READ and IRP_MJ_WRITE

>
>
>
> Hi All,
> I need a help to trace the owner of the Call ( Process Name ). During the
> IRP_MJ_READ and IRP_MJ_WRITE.
> I have used,
>
> PEPROCESS curproc = PsGetCurrentProcess();
>
> But Here I am Facing Strange Problem. When POWERPOINT is Writing Data in
> .ppt File I get some time EXCEL as a Process Name.
> Both the Application are Opened and I am Working on them Simultaneously.
>
> Regards,
> Utkarsh S. Dabhade
>
>
>
> Disclaimer:
> The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone other
than the intended addressee(s). In case you are not the desired addressee,
you should delete this message and/or re-direct it to the sender. The views
expressed in this E-mail message (including the enclosure(s) or
attachment(s)
if any) are those of the individual sender, except where the sender
expressly,
and with authority, states them to be the views of MBT.
>
> This e-mail message including attachment/(s), if any, is believed to be
free
of any virus. However, it is the responsibility of the recipient to ensure
that it is virus free and MBT is not responsible for any loss or damage
arising
in any way from its use
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@mahindrabt.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use