Properly passing through FastIoQueryOpen call

Here is the question I have and maybe someone out there knows the answer:
How should the correct pre/post processing code looks like, for simply
passing down the FastIoQueryOpen call from FSFD to the (target) FSD?
I’ve checked the Sysinternals FILEMON; Rajeev Nagar SFilter; and MS IFSKit’s
SFilter, FileSpy, TFilter examples.
All (!) of them (IFSKit SFilter and FileSpy share the same approach) use a
different code in pre/post-processing before calling the “original” target
FSD FastIoQueryOpen. Unfortunately FASTFAT example from IFSKit (or others),
doesn’t implement FastIoQueryOpen call, to see how this call is handled in
FSD.
Searching through the ntfsd archive e-mails, I found one reply from Max S.
Shatskih regarding rules to follow in passing down the FastIoQueryOpen
(similar to how IFSKit SFilter handles it). There is also a note that
falling to do it that way, you risk a NTFS_FILE_SYSTEM BSOD (0x24,
0x0019XXXX, …).
I hope that FastIoQueryOpen “minestrone” (all-kind-of-vegetables soup) is
spicy enough, to trigger some reply. Thanks in advance.
Wbr Primoz


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

The IRP in question is an IRP_MJ_CREATE Irp. The operation combines an open
of a file, a query for network open information, a cleanup, and a close, all
in one convenient package. To the best of my knowledge, only NTFS
implements this, although there is no reason other file systems cannot (it
actually DOES improve performance for SRV, since this is a common operation
for SRV.)

So, from the IRP perspective there isn’t very much you need to do to pass it
along. SFilter’s approach of updating the device object is certainly a
reasonable one (since the device object should be that for YOUR filter)
although from what I can ascertain it would be unusual for ANY file system
to use the DeviceObject argument from the stack location (and the absence of
such code from other examples probably works fortuitously because of this
fact.) I’d stick with this approach.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

-----Original Message-----
From: Primoz Beltram [mailto:xxxxx@hermes.si]
Sent: Tuesday, January 08, 2002 6:04 AM
To: File Systems Developers
Subject: [ntfsd] Properly passing through FastIoQueryOpen call

Here is the question I have and maybe someone out there knows the answer:

How should the correct pre/post processing code looks like, for simply
passing down the FastIoQueryOpen call from FSFD to the (target) FSD?

I’ve checked the Sysinternals FILEMON; Rajeev Nagar SFilter; and MS IFSKit’s
SFilter, FileSpy, TFilter examples.

All (!) of them (IFSKit SFilter and FileSpy share the same approach) use a
different code in pre/post-processing before calling the “original” target
FSD FastIoQueryOpen. Unfortunately FASTFAT example from IFSKit (or others),
doesn’t implement FastIoQueryOpen call, to see how this call is handled in
FSD.

Searching through the ntfsd archive e-mails, I found one reply from Max S.
Shatskih regarding rules to follow in passing down the FastIoQueryOpen
(similar to how IFSKit SFilter handles it). There is also a note that
falling to do it that way, you risk a NTFS_FILE_SYSTEM BSOD (0x24,
0x0019XXXX, …).

I hope that FastIoQueryOpen “minestrone” (all-kind-of-vegetables soup) is
spicy enough, to trigger some reply. Thanks in advance.

Wbr Primoz


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Properly passing through FastIoQueryOpen callI used code from SFilter and code from Filemon. Both of them are working. I’m using one from Filemon no and have no probles. I think there’s no single proper way for doing that. All code is working. Decide what you need or what you like yourself.

Alexey Logachyov
xxxxx@vba.com.by
VirusBlokAda ltd.
http://www.vba.com.by

----- Original Message -----
From: Primoz Beltram
To: File Systems Developers
Sent: Tuesday, January 08, 2002 1:04 PM
Subject: [ntfsd] Properly passing through FastIoQueryOpen call

Here is the question I have and maybe someone out there knows the answer:

How should the correct pre/post processing code looks like, for simply passing down the FastIoQueryOpen call from FSFD to the (target) FSD?

I’ve checked the Sysinternals FILEMON; Rajeev Nagar SFilter; and MS IFSKit’s SFilter, FileSpy, TFilter examples.

All (!) of them (IFSKit SFilter and FileSpy share the same approach) use a different code in pre/post-processing before calling the “original” target FSD FastIoQueryOpen. Unfortunately FASTFAT example from IFSKit (or others), doesn’t implement FastIoQueryOpen call, to see how this call is handled in FSD.

Searching through the ntfsd archive e-mails, I found one reply from Max S. Shatskih regarding rules to follow in passing down the FastIoQueryOpen (similar to how IFSKit SFilter handles it). There is also a note that falling to do it that way, you risk a NTFS_FILE_SYSTEM BSOD (0x24, 0x0019XXXX, …).

I hope that FastIoQueryOpen “minestrone” (all-kind-of-vegetables soup) is spicy enough, to trigger some reply. Thanks in advance.

Wbr Primoz


You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Properly passing through FastIoQueryOpen call>Searching through the ntfsd archive e-mails, I found one reply from Max S. Shatskih

regarding rules to follow in passing down the FastIoQueryOpen (similar to how IFSKit

From my old code, which is working on NT4 and never tested on w2k.
DeviceExtension->FastIoDispatch is the lower driver’s FastIo table saved on attach time.

// Extract the current IRP stack location
CurrentLoc = IoGetCurrentIrpStackLocation(Irp);

(large skip)

// Check the lower driver’s FastIo table
DeviceExtension = (PVFP_FS_FILTER_DEVICE_EXTENSION)(DeviceObject->DeviceExtension);
if( DeviceExtension->FastIoDispatch.FastIoQueryOpen != NULL )
{
BOOLEAN RetVal;
// Exists
// Update the device object in the IRP to the lower device object
// before calling the lower driver
// This is necessary - the FSD (like Ntfs) requires that CurrentLoc->DeviceObject
// is the real volume’s device object, not the upper filter’s one
// Forgetting to do this causes uncaught exception in NtfsPingVolume
// and NTFS_FILE_SYSTEM BSOD with Parameter1 == 0x0019xxxx
CurrentLoc->DeviceObject = DeviceExtension->TargetDeviceObject;
RetVal = DeviceExtension->FastIoDispatch.FastIoQueryOpen(Irp, NetworkInformation,
// Use the lower device object here
DeviceExtension->TargetDeviceObject);
// Set the device object back
CurrentLoc->DeviceObject = DeviceObject;
return RetVal;
}

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Currently, since I have a requirement to do so, I just fail this
request.

Primoz Beltram wrote:

Here is the question I have and maybe someone out there knows the
answer:
How should the correct pre/post processing code looks like, for simply

passing down the FastIoQueryOpen call from FSFD to the (target) FSD?
I’ve checked the Sysinternals FILEMON; Rajeev Nagar SFilter; and MS
IFSKit’s
SFilter, FileSpy, TFilter examples.
All (!) of them (IFSKit SFilter and FileSpy share the same approach)
use a
different code in pre/post-processing before calling the “original”
target
FSD FastIoQueryOpen. Unfortunately FASTFAT example from IFSKit (or
others),
doesn’t implement FastIoQueryOpen call, to see how this call is
handled in
FSD.
Searching through the ntfsd archive e-mails, I found one reply from
Max S.
Shatskih regarding rules to follow in passing down the FastIoQueryOpen

(similar to how IFSKit SFilter handles it). There is also a note that
falling to do it that way, you risk a NTFS_FILE_SYSTEM BSOD (0x24,
0x0019XXXX, …).
I hope that FastIoQueryOpen “minestrone” (all-kind-of-vegetables soup)
is
spicy enough, to trigger some reply. Thanks in advance.
Wbr Primoz


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com