Sorry, But this is only correct when filtering operations when the machine
running the hook is doing the open operation.
The flag is IFSFH_RES_LOCAL when someone remotely opens a file on the
machine
through a share.
Rob Linegar
Software Engineer
Data Encryption Systems Limited
-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@alfasp.com]
Sent: 24 January 2002 17:36
To: File Systems Developers
Subject: [ntfsd] Re: File system hook issue with remote
requests (9X/ME
related)I didn’t see a question:-)
You can determine whether it’s local or remote access via
ResType parameter
of the IFS Hook function.
It will be have IFSFH_RES_LOCAL bit set, unless the
resource is remote.
You should not rely on process name.Regards, Dejan.
xxxxx@des.co.uk wrote:
> I’m currently investigating an issue with a vxd that uses the
> IFSMgr_InstallFileSystemApiHook service to hook the file
system under 9X/ME.
>
> I am trying to determine whether a file access is being
performed via a
> local
> request or as the result of a remote request (e.g. access
of file through a
> share).
>
> The only thing I have found thus far is that the process id
(pioreq->ir_pid)
> for the
> IFSFN_OPEN request when the access is remote is for
0x8000FEFF. From what
> little I have found
> out so far this could also happen when local Ring 0 file
access is invoked.
> (Using Filemon this access shows as being performed by Kernel32.)
>
> Rob Linegar
> Software Engineer
> Data Encryption Systems Limited
>
> —
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for
Win32 developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for
Win32 developers.
You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com