Re[6]: open files which are already opened in exclusi ve shared mode

NTFSD
1

I succeeded opening files which are already opened by other processes
in my filter driver but it seems to be not working in some cases.

For example:
I can open:
* “%SYSTEMROOT%\config\default”
* “c:$mft”

I cannot open:
* “c:\pagefile.sys”
* “c:$boot”

What can be a reason?

–
Roman Kudinov

mailto:Roman Kudinov

Friday, September 3, 2004, 3:10:54 PM, you wrote:

PB> Unfortunately no, since handle is open with SYNCHRONIZE DesiredAccess (to
PB> avoid sharing failure in open) and IO manager (or some other manager) will
PB> fail your ZwRead by handle.
PB> WBR Primoz

PB> -----Original Message-----
PB> From: Roman Kudinov [mailto:xxxxx@rbcmail.ru]
PB> Sent: Friday, September 03, 2004 12:54 PM
PB> To: Windows File Systems Devs Interest List
PB> Subject: Re[4]: [ntfsd] open files which are already opened in exclusi ve
PB> shared mode

PB> Hello Primoz,

PB> ah, so I should roll IRPs, can’t I access files by handle?

2

Those files are internally restricted by NTFS and no external
application is allowed to open them.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roman Kudinov
Sent: Tuesday, September 14, 2004 12:56 AM
To: Windows File Systems Devs Interest List
Subject: Re[6]: [ntfsd] open files which are already opened in exclusi
ve shared mode

I succeeded opening files which are already opened by other processes
in my filter driver but it seems to be not working in some cases.

For example:
I can open:
* “%SYSTEMROOT%\config\default”
* “c:$mft”

I cannot open:
* “c:\pagefile.sys”
* “c:$boot”

What can be a reason?

–
Roman Kudinov

mailto:Roman Kudinov

Friday, September 3, 2004, 3:10:54 PM, you wrote:

PB> Unfortunately no, since handle is open with SYNCHRONIZE
DesiredAccess (to
PB> avoid sharing failure in open) and IO manager (or some other
manager) will
PB> fail your ZwRead by handle.
PB> WBR Primoz

PB> -----Original Message-----
PB> From: Roman Kudinov [mailto:xxxxx@rbcmail.ru]
PB> Sent: Friday, September 03, 2004 12:54 PM
PB> To: Windows File Systems Devs Interest List
PB> Subject: Re[4]: [ntfsd] open files which are already opened in
exclusi ve
PB> shared mode

PB> Hello Primoz,

PB> ah, so I should roll IRPs, can’t I access files by handle?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com