question about filter driver IRP_MJ_CREATE

Filename buffer is allocated via ExAllocatePool() and if you replace the
buffer with your own, you must allocate it from ExAllocatePool() because
the file system WILL call ExFreePool() on that buffer.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@seagate.com
Sent: Friday, February 22, 2002 10:03 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

If you haven’t done the allocation of FileName.Buffer, this has some
risk, as you *could* be ExFreePool() ing a static string. Or maybe the
caller might like to refer to that buffer again. It’s unlikely, but
possible.

Of course, if you allocated it, then that won’t be happening. I am only
addressing the snippet below, not the original problem. Perhaps in the
original problem statement it was made clear that you own the buffer you
are freeing.

Phil

“Jamey Kirby” @lists.osr.com on 02/22/2002
08:57:42 AM

Please respond to “File Systems Developers”

Sent by: xxxxx@lists.osr.com

To: “File Systems Developers”
cc:

Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Here is how I do it:

if( fileObject->FileName.Buffer != NULL )
ExFreePool(fileObject->FileName.Buffer);
RtlInitUnicodeString(&fileObject->FileName, nameBuffer);
fileObject->RelatedFileObject = NULL;
Irp->IoStatus.Information = IO_REPARSE;
ntStatus = Irp->IoStatus.Status = STATUS_REPARSE;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return ntStatus;

Jamey


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I assume that nameBuffer is L"\??\C:\TEMP\file.ext" and can be
replaced by the above string. Is there anything wrong with this?

The program hangs after it calls the return STATUS_REPARSE line.

Thanks for your help.

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/22/02 11:57 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Here is how I do it:

if( fileObject->FileName.Buffer != NULL )
ExFreePool(fileObject->FileName.Buffer);
RtlInitUnicodeString(&fileObject->FileName, nameBuffer);
fileObject->RelatedFileObject = NULL;
Irp->IoStatus.Information = IO_REPARSE;
ntStatus = Irp->IoStatus.Status = STATUS_REPARSE;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return ntStatus;

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Fuller, Rob
Sent: Friday, February 22, 2002 6:26 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

The documentation for RtlAnsiStringToUnicodeString says the function
RtlFreeUnicodeString must be used to free the buffer. Perhaps the “IO
Manager” uses ExFreePool, and this is not the same as
RtlFreeUnicodeString?

-----Original Message-----
From: Loh Lik Yong Winston [mailto:xxxxx@nus.edu.sg]
Sent: Friday, February 22, 2002 4:41 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Hi all,

I am unsure of how to do this. I tried the following piece of code but
it crashes the entire system.


Irp->IoStatus.Information = IO_REPARSE;
RtlAnsiStringToUnicodeString(&FileObject->FileName,
“C:\TEMP\file.ext”, TRUE);
return STATUS_REPARSE;

I have also tried RtlCopyString, strcpy, memcpy in addition to the
RtlAnsiStringToUnicodeString function but all result in the system
crashing.

Would appreciate your help in resolving this matter. Thank you.

Winston

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/19/02 12:30 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Easy…

On the create call, change the filename in the file object, set
IoStatus.Infomation to IO_REPARSE and return STATUS_REPARSE; look Mom,
no hands :slight_smile:

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Tuesday, February 19, 2002 2:31 AM
To: File Systems Developers
Subject: [ntfsd] question about filter driver IRP_MJ_CREATE

Hi,

I am developing a Win2K filter driver. One of the functions of the
filter driver is to re-route the file object handles of the
IRP_MJ_CREATE function for certain programs. For example, say I have
got a program A which is trying to obtain a file handle for
c:\file1.ext, I would like to re-route this to c:\temp\file1.ext for the

program A. Other programs may be routed to other directories or even
access the c:\file1.ext itself.

It is my understanding that when the I/O Manager calls the filesystem
driver to obtain a file handle, one of the parameters that would be
passed is the ObjectAttributes structure. One of the fields in this is
the ObjectName field that contains the full path name to the file that
it would like to obtain the file handle for. I would like to change the

value of the ObjectName field so that its value changes from
“c:\file1.ext” to “c:\temp\file1.ext” when program A tries to access the

file. Theoretically speaking, if the value of this field is changed,
then the file handle returned to program A will have been correctly
routed. However, I am unsure of how to change the value for the
ObjectName string. I would appreciate it if someone could tell me how I

can do this. Is it possible or do I need to call
InitializeObjectAttributes and create a new ObjectAttributes instead?

Appreciate your help in this matter. Thanks.

Jamey, is it possible to change only the last char of the name buffer,
without deallocating/allocating memory? Does REPARSE
always needs full filename in \??\… style and RelatedFileObject=NULL?

Kind regards,
-Svetoslav Enkov,
Aivan7 GmbH

It depends. Are you filtering only certain files, or, are you filtering
and reparsing all files?

If you are reparsing all files, I suspect you have a problem in that
some files (maybe system file) may not exist in the target yet.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Monday, February 25, 2002 12:28 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

I assume that nameBuffer is L"\??\C:\TEMP\file.ext" and can be
replaced by the above string. Is there anything wrong with this?

The program hangs after it calls the return STATUS_REPARSE line.

Thanks for your help.

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/22/02 11:57 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Here is how I do it:

if( fileObject->FileName.Buffer != NULL )
ExFreePool(fileObject->FileName.Buffer);
RtlInitUnicodeString(&fileObject->FileName, nameBuffer);
fileObject->RelatedFileObject = NULL;
Irp->IoStatus.Information = IO_REPARSE;
ntStatus = Irp->IoStatus.Status = STATUS_REPARSE;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return ntStatus;

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Fuller, Rob
Sent: Friday, February 22, 2002 6:26 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

The documentation for RtlAnsiStringToUnicodeString says the function
RtlFreeUnicodeString must be used to free the buffer. Perhaps the “IO
Manager” uses ExFreePool, and this is not the same as
RtlFreeUnicodeString?

-----Original Message-----
From: Loh Lik Yong Winston [mailto:xxxxx@nus.edu.sg]
Sent: Friday, February 22, 2002 4:41 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Hi all,

I am unsure of how to do this. I tried the following piece of code but
it crashes the entire system.


Irp->IoStatus.Information = IO_REPARSE;
RtlAnsiStringToUnicodeString(&FileObject->FileName,
“C:\TEMP\file.ext”, TRUE);
return STATUS_REPARSE;

I have also tried RtlCopyString, strcpy, memcpy in addition to the
RtlAnsiStringToUnicodeString function but all result in the system
crashing.

Would appreciate your help in resolving this matter. Thank you.

Winston

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/19/02 12:30 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Easy…

On the create call, change the filename in the file object, set
IoStatus.Infomation to IO_REPARSE and return STATUS_REPARSE; look Mom,
no hands :slight_smile:

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Tuesday, February 19, 2002 2:31 AM
To: File Systems Developers
Subject: [ntfsd] question about filter driver IRP_MJ_CREATE

Hi,

I am developing a Win2K filter driver. One of the functions of the
filter driver is to re-route the file object handles of the
IRP_MJ_CREATE function for certain programs. For example, say I have
got a program A which is trying to obtain a file handle for
c:\file1.ext, I would like to re-route this to c:\temp\file1.ext for the

program A. Other programs may be routed to other directories or even
access the c:\file1.ext itself.

It is my understanding that when the I/O Manager calls the filesystem
driver to obtain a file handle, one of the parameters that would be
passed is the ObjectAttributes structure. One of the fields in this is
the ObjectName field that contains the full path name to the file that
it would like to obtain the file handle for. I would like to change the

value of the ObjectName field so that its value changes from
“c:\file1.ext” to “c:\temp\file1.ext” when program A tries to access the

file. Theoretically speaking, if the value of this field is changed,
then the file handle returned to program A will have been correctly
routed. However, I am unsure of how to change the value for the
ObjectName string. I would appreciate it if someone could tell me how I

can do this. Is it possible or do I need to call
InitializeObjectAttributes and create a new ObjectAttributes instead?

Appreciate your help in this matter. Thanks.


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to %%email.unsub%%

If you change only the last character, you do not need to return
STATUS_REPARSE.

Actually, reparse is only useful when the redirection is to another
volume or FSD. It te reparse is on the same volume, just free and
reallocate a new name and send it on down the chain (with no \??\).

Jamey

-----Original Message-----
From: Svetoslav Enkov [mailto:xxxxx@aivan7.net]
Sent: Monday, February 25, 2002 5:27 AM
To: xxxxx@storagecraft.com
Cc: File Systems Developers
Subject: RE: question about filter driver IRP_MJ_CREATE

Jamey, is it possible to change only the last char of the name buffer,
without deallocating/allocating memory? Does REPARSE
always needs full filename in \??\… style and
RelatedFileObject=NULL?

Kind regards,
-Svetoslav Enkov,
Aivan7 GmbH

I am only filtering certain files and not all files.

umm… I’m not sure by what you mean that the file may not exist in the
target yet. What if I want to create a new file in the target? Would I not
be able to use the reparse to do this?

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/25/02 11:44 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

It depends. Are you filtering only certain files, or, are you filtering
and reparsing all files?

If you are reparsing all files, I suspect you have a problem in that
some files (maybe system file) may not exist in the target yet.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Monday, February 25, 2002 12:28 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

I assume that nameBuffer is L"\??\C:\TEMP\file.ext" and can be
replaced by the above string. Is there anything wrong with this?

The program hangs after it calls the return STATUS_REPARSE line.

Thanks for your help.

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/22/02 11:57 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Here is how I do it:

if( fileObject->FileName.Buffer != NULL )
ExFreePool(fileObject->FileName.Buffer);
RtlInitUnicodeString(&fileObject->FileName, nameBuffer);
fileObject->RelatedFileObject = NULL;
Irp->IoStatus.Information = IO_REPARSE;
ntStatus = Irp->IoStatus.Status = STATUS_REPARSE;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return ntStatus;

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Fuller, Rob
Sent: Friday, February 22, 2002 6:26 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

The documentation for RtlAnsiStringToUnicodeString says the function
RtlFreeUnicodeString must be used to free the buffer. Perhaps the “IO
Manager” uses ExFreePool, and this is not the same as
RtlFreeUnicodeString?

-----Original Message-----
From: Loh Lik Yong Winston [mailto:xxxxx@nus.edu.sg]
Sent: Friday, February 22, 2002 4:41 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Hi all,

I am unsure of how to do this. I tried the following piece of code but
it crashes the entire system.


Irp->IoStatus.Information = IO_REPARSE;
RtlAnsiStringToUnicodeString(&FileObject->FileName,
“C:\TEMP\file.ext”, TRUE);
return STATUS_REPARSE;

I have also tried RtlCopyString, strcpy, memcpy in addition to the
RtlAnsiStringToUnicodeString function but all result in the system
crashing.

Would appreciate your help in resolving this matter. Thank you.

Winston

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/19/02 12:30 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Easy…

On the create call, change the filename in the file object, set
IoStatus.Infomation to IO_REPARSE and return STATUS_REPARSE; look Mom,
no hands :slight_smile:

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Tuesday, February 19, 2002 2:31 AM
To: File Systems Developers
Subject: [ntfsd] question about filter driver IRP_MJ_CREATE

Hi,

I am developing a Win2K filter driver. One of the functions of the
filter driver is to re-route the file object handles of the
IRP_MJ_CREATE function for certain programs. For example, say I have
got a program A which is trying to obtain a file handle for
c:\file1.ext, I would like to re-route this to c:\temp\file1.ext for the

program A. Other programs may be routed to other directories or even
access the c:\file1.ext itself.

It is my understanding that when the I/O Manager calls the filesystem
driver to obtain a file handle, one of the parameters that would be
passed is the ObjectAttributes structure. One of the fields in this is
the ObjectName field that contains the full path name to the file that
it would like to obtain the file handle for. I would like to change the

value of the ObjectName field so that its value changes from
“c:\file1.ext” to “c:\temp\file1.ext” when program A tries to access the

file. Theoretically speaking, if the value of this field is changed,
then the file handle returned to program A will have been correctly
routed. However, I am unsure of how to change the value for the
ObjectName string. I would appreciate it if someone could tell me how I

can do this. Is it possible or do I need to call
InitializeObjectAttributes and create a new ObjectAttributes instead?

Appreciate your help in this matter. Thanks.


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@nus.edu.sg
To unsubscribe send a blank email to %%email.unsub%%

I am writing a filter driver.

I want to read a file whenever the an IRP_MJ_CREATE is received. The codes
are as follow:

// Initialize the event
KeInitializeEvent(&event, SynchronizationEvent, FALSE);

// Allocate an irp for this request. This could also come from a
// private pool, for instance.
irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
if (!irp)
{
DbgPrint(“ERROR! - IoAllocateIrp fail!\n”);
return ERROR;
}

if (FileObject->FileName.Buffer != NULL)
{
ExFreePool(FileObject->FileName.Buffer);
}
RtlInitUnicodeString(&FileObject->FileName, NewFileToBeRead);
FileObject->RelatedFileObject = NULL;

// Build the IRP’s main body
irp->AssociatedIrp.SystemBuffer = ExAllocatePool(NonPagedPool, MAX_SIZE);
irp->Flags = SL_OPEN_PAGING_FILE;
irp->RequestorMode = KernelMode;
irp->Tail.Overlay.Thread = PsGetCurrentThread();
irp->Tail.Overlay.OriginalFileObject = FileObject;
irp->UserEvent = &event;
irp->UserIosb = &IoStatusBlock;
irp->MdlAddress = NULL;
irp->UserBuffer = NULL;

// Set up the I/O stack location.
ioStackLocation = IoGetNextIrpStackLocation(irp);
ioStackLocation->MajorFunction = IRP_MJ_CREATE;
ioStackLocation->DeviceObject = DeviceObject;
ioStackLocation->FileObject = FileObject;
ioStackLocation->Parameters.Create.EaLength = MAX_SIZE;
ioStackLocation->Parameters.Create.Options = FILE_NON_DIRECTORY_FILE;
ioStackLocation->Parameters.Create.ShareAccess = FILE_SHARE_READ;

// Set the completion routine.
IoSetCompletionRoutine(irp, MyComplete, 0, TRUE, TRUE, TRUE);

// Send it to the FSD
(void) IoCallDriver(DeviceObject, irp);

// Wait for the I/O
KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);

My computer also halts. What’s wrong with my code?

Do I need to make a IRP_MJ_CREATE before IRP_MJ_READ to read the file?

When I try to create my own IRP for IRP_MJ_CREATE,

I setup the objectattribute with the UNICODE_STRING “//??//C://abc.txt”
and get STATUS_OBJECT_NAME_INVALID.

If I use the UNICODE_STRING “//DosDevice//C://abc.txt” then I get
STATUS_OBJECT_PATH_INVALID.

Why do I get these errors and what is the difference between them?

This is Windows. Use "" not “/”.

-----Original Message-----
From: Eric Chan [mailto:xxxxx@hotmail.com]
Sent: Tuesday, March 05, 2002 6:30 AM
To: File Systems Developers
Subject: [ntfsd] IRP_MJ_CREATE

When I try to create my own IRP for IRP_MJ_CREATE,

I setup the objectattribute with the UNICODE_STRING “//??//C://abc.txt”
and get STATUS_OBJECT_NAME_INVALID.

If I use the UNICODE_STRING “//DosDevice//C://abc.txt” then I get
STATUS_OBJECT_PATH_INVALID.

Why do I get these errors and what is the difference between them?


You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

Oops, I just type it wrong in the post.

I got STATUS_OBJECT_NAME_INVALID when I use “\??\C:\abc.txt”

and STATUS_OBJECT_PATH_INVALID when I use “\DosDevice\C:\abc.txt”

Anybody know why I got errors and what’s the differences betweent these
two errors?

Did you use unicode string? If not you should.

I think L"\DosDevice\C:\abc.txt" is wrong.
Use shoud be L"\DosDevices\C:\abc.txt".

The first error means your file name has problem,
while
the second means the path is not correct.

Good Luck.
Lijun.
— Eric Chan wrote:
> Oops, I just type it wrong in the post.
>
> I got STATUS_OBJECT_NAME_INVALID when I use
> “\??\C:\abc.txt”
>
> and STATUS_OBJECT_PATH_INVALID when I use
> “\DosDevice\C:\abc.txt”
>
> Anybody know why I got errors and what’s the
> differences betweent these
> two errors?
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%

=====

__________________________________________________
Do You Yahoo!?
Try FREE Yahoo! Mail - the world’s greatest free email!
http://mail.yahoo.com/

Allocate the string for FileObject->FileName.Buffer from paged pool, then use something like RtlCopyMemory or RtlInitUnicodeString
to put the characters there.

Max

----- Original Message -----
From: “Loh Lik Yong Winston”
To: “File Systems Developers”
Sent: Friday, February 22, 2002 12:41 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

> Hi all,
>
> I am unsure of how to do this. I tried the following piece of code but
> it crashes the entire system.
>
> …
> Irp->IoStatus.Information = IO_REPARSE;
> RtlAnsiStringToUnicodeString(&FileObject->FileName,
> “C:\TEMP\file.ext”, TRUE);
> return STATUS_REPARSE;
> …
>
> I have also tried RtlCopyString, strcpy, memcpy in addition to the
> RtlAnsiStringToUnicodeString function but all result in the system
> crashing.
>
> Would appreciate your help in resolving this matter. Thank you.
>
> Winston
>
>
> -----Original Message-----
> From: Jamey Kirby
> To: File Systems Developers
> Sent: 2/19/02 12:30 PM
> Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE
>
> Easy…
>
> On the create call, change the filename in the file object, set
> IoStatus.Infomation to IO_REPARSE and return STATUS_REPARSE; look Mom,
> no hands :slight_smile:
>
> Jamey
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
> Winston
> Sent: Tuesday, February 19, 2002 2:31 AM
> To: File Systems Developers
> Subject: [ntfsd] question about filter driver IRP_MJ_CREATE
>
>
>
> Hi,
>
> I am developing a Win2K filter driver. One of the functions of the
> filter driver is to re-route the file object handles of the
> IRP_MJ_CREATE function for certain programs. For example, say I have
> got a program A which is trying to obtain a file handle for
> c:\file1.ext, I would like to re-route this to c:\temp\file1.ext for the
> program A. Other programs may be routed to other directories or even
> access the c:\file1.ext itself.
>
> It is my understanding that when the I/O Manager calls the filesystem
> driver to obtain a file handle, one of the parameters that would be
> passed is the ObjectAttributes structure. One of the fields in this is
> the ObjectName field that contains the full path name to the file that
> it would like to obtain the file handle for. I would like to change the
> value of the ObjectName field so that its value changes from
> “c:\file1.ext” to “c:\temp\file1.ext” when program A tries to access the
> file. Theoretically speaking, if the value of this field is changed,
> then the file handle returned to program A will have been correctly
> routed. However, I am unsure of how to change the value for the
> ObjectName string. I would appreciate it if someone could tell me how I
> can do this. Is it possible or do I need to call
> InitializeObjectAttributes and create a new ObjectAttributes instead?
>
> Appreciate your help in this matter. Thanks.
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>

They were always the same IIRC.

----- Original Message -----
From: “Fuller, Rob”
To: “File Systems Developers”
Sent: Friday, February 22, 2002 5:25 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

The documentation for RtlAnsiStringToUnicodeString says the function RtlFreeUnicodeString must be used to free the buffer. Perhaps
the “IO Manager” uses ExFreePool, and this is not the same as RtlFreeUnicodeString?

-----Original Message-----
From: Loh Lik Yong Winston [mailto:xxxxx@nus.edu.sg]
Sent: Friday, February 22, 2002 4:41 AM
To: File Systems Developers
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Hi all,

I am unsure of how to do this. I tried the following piece of code but
it crashes the entire system.


Irp->IoStatus.Information = IO_REPARSE;
RtlAnsiStringToUnicodeString(&FileObject->FileName,
“C:\TEMP\file.ext”, TRUE);
return STATUS_REPARSE;


I have also tried RtlCopyString, strcpy, memcpy in addition to the
RtlAnsiStringToUnicodeString function but all result in the system
crashing.

Would appreciate your help in resolving this matter. Thank you.

Winston

-----Original Message-----
From: Jamey Kirby
To: File Systems Developers
Sent: 2/19/02 12:30 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Easy…

On the create call, change the filename in the file object, set
IoStatus.Infomation to IO_REPARSE and return STATUS_REPARSE; look Mom,
no hands :slight_smile:

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loh Lik Yong
Winston
Sent: Tuesday, February 19, 2002 2:31 AM
To: File Systems Developers
Subject: [ntfsd] question about filter driver IRP_MJ_CREATE

Hi,

I am developing a Win2K filter driver. One of the functions of the
filter driver is to re-route the file object handles of the
IRP_MJ_CREATE function for certain programs. For example, say I have
got a program A which is trying to obtain a file handle for
c:\file1.ext, I would like to re-route this to c:\temp\file1.ext for the
program A. Other programs may be routed to other directories or even
access the c:\file1.ext itself.

It is my understanding that when the I/O Manager calls the filesystem
driver to obtain a file handle, one of the parameters that would be
passed is the ObjectAttributes structure. One of the fields in this is
the ObjectName field that contains the full path name to the file that
it would like to obtain the file handle for. I would like to change the
value of the ObjectName field so that its value changes from
“c:\file1.ext” to “c:\temp\file1.ext” when program A tries to access the
file. Theoretically speaking, if the value of this field is changed,
then the file handle returned to program A will have been correctly
routed. However, I am unsure of how to change the value for the
ObjectName string. I would appreciate it if someone could tell me how I
can do this. Is it possible or do I need to call
InitializeObjectAttributes and create a new ObjectAttributes instead?

Appreciate your help in this matter. Thanks.


You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

Are you passing these via ZwCreateFile, or via IoCallDriver, after
setting up an IRP?
The second method requires relative, not fully qualified path names,
i.e. to open a file on drive C, use “\abc.txt”.

Regards, Dejan.

Eric Chan wrote:

Oops, I just type it wrong in the post.

I got STATUS_OBJECT_NAME_INVALID when I use “\??\C:\abc.txt”

and STATUS_OBJECT_PATH_INVALID when I use “\DosDevice\C:\abc.txt”

Anybody know why I got errors and what’s the differences betweent these
two errors?


You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

Try single reverse backslashes.

----- Original Message -----
From: “Eric Chan”
To: “File Systems Developers”
Sent: Tuesday, March 05, 2002 2:29 PM
Subject: [ntfsd] IRP_MJ_CREATE

> When I try to create my own IRP for IRP_MJ_CREATE,
>
> I setup the objectattribute with the UNICODE_STRING “//??//C://abc.txt”
> and get STATUS_OBJECT_NAME_INVALID.
>
> If I use the UNICODE_STRING “//DosDevice//C://abc.txt” then I get
> STATUS_OBJECT_PATH_INVALID.
>
> Why do I get these errors and what is the difference between them?
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>

Max,

You usually are right on, but you completely missed this one. The real
problem is passing a char* to a routine that takes a PANSI_STRING.

Phil

“Maxim S. Shatskih” @lists.osr.com on 03/05/2002
08:33:11 AM

Please respond to “File Systems Developers”

Sent by: xxxxx@lists.osr.com

To: “File Systems Developers”
cc:

Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

Allocate the string for FileObject->FileName.Buffer from paged pool, then
use something like RtlCopyMemory or RtlInitUnicodeString
to put the characters there.

Max

----- Original Message -----
From: “Loh Lik Yong Winston”
To: “File Systems Developers”
Sent: Friday, February 22, 2002 12:41 PM
Subject: [ntfsd] RE: question about filter driver IRP_MJ_CREATE

> Hi all,
>
> I am unsure of how to do this. I tried the following piece of code but
> it crashes the entire system.
>
> …
> Irp->IoStatus.Information = IO_REPARSE;
> RtlAnsiStringToUnicodeString(&FileObject->FileName,
> “C:\TEMP\file.ext”, TRUE);
> return STATUS_REPARSE;
> …
>
> I have also tried RtlCopyString, strcpy, memcpy in addition to the
> RtlAnsiStringToUnicodeString function but all result in the system
> crashing.

You’re kidding, right?

“Maxim S. Shatskih” @lists.osr.com on 03/06/2002
12:10:02 AM

Please respond to “File Systems Developers”

Sent by: xxxxx@lists.osr.com

To: “File Systems Developers”
cc:

Subject: [ntfsd] Re: IRP_MJ_CREATE

Try single reverse backslashes.

----- Original Message -----
From: “Eric Chan”
To: “File Systems Developers”
Sent: Tuesday, March 05, 2002 2:29 PM
Subject: [ntfsd] IRP_MJ_CREATE

> When I try to create my own IRP for IRP_MJ_CREATE,
>
> I setup the objectattribute with the UNICODE_STRING “//??//C://abc.txt”
> and get STATUS_OBJECT_NAME_INVALID.

[snip]