Rob,
try to check Driver (3rd) parameter passed to IFS hook. In my old code which
uses it there is a check which distinguishes local drives as being <= (‘Z’ -
‘A’ + 1) and network as others. IIRC for network drives the value was 0xFF.
It was for IFSFN_WRITE, I’m not sure about opens. Also, even if works I’m
not sure about validity; I’ve added this code to avoid problems with driver
letters other than A to Z which weren’t interesting for my driver.
Best regards,
Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]
From: xxxxx@des.co.uk[SMTP:xxxxx@des.co.uk]
Reply To: xxxxx@lists.osr.com
Sent: Thursday, January 24, 2002 6:10 PM
To: xxxxx@lists.osr.com
Subject: [ntfsd] File system hook issue with remote requests (9X/ME
related)I’m currently investigating an issue with a vxd that uses the
IFSMgr_InstallFileSystemApiHook service to hook the file system under
9X/ME.I am trying to determine whether a file access is being performed via a
local
request or as the result of a remote request (e.g. access of file through
a
share).The only thing I have found thus far is that the process id
(pioreq->ir_pid)
for the
IFSFN_OPEN request when the access is remote is for 0x8000FEFF. From what
little I have found
out so far this could also happen when local Ring 0 file access is
invoked.
(Using Filemon this access shows as being performed by Kernel32.)Rob Linegar
Software Engineer
Data Encryption Systems Limited
You are currently subscribed to ntfsd as: michal.vodicka@st.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com