thanks
FltCreateFile need volume instance so If this parameter is *NULL*, the
request is sent to the device object at the top of the file system driver
stack for the volume. If it is non-*NULL*, the request is sent only to
minifilter driver instances that are attached below the specified instance.
and i don’t have second volume instance my irp is for file access and
process is on another volume
befor asking i read msdn and +20 posts in this site 
On Mon, Dec 22, 2014 at 8:36 PM, wrote:
> Hi Maysam,
>
> Using ZwCreateFile makes I/O Manager to create a new IRP and send it to
> the top of the device stack, passing through your filter again. You’re
> probably getting out of stack and then seeing the crash.
> Try using FltCreateFile, which gives you the opportunity to create the IRP
> and send it from your instance to down the stack, preventing the IRP from
> going to the top of the device stack.
>
> Regards,
> –
> Fernando Roberto da Silva
> DriverEntry Kernel Development
> http://www.driverentry.com.br
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
thanks
i attach to all volumes so i must check process file is on which volume
and use appropriate volume instance object with FltCreateFile ,
how correctly detect volume and map to its volume instance object?
On Mon, Dec 22, 2014 at 9:51 PM, wrote:
> Don’t your filter attach to the C volume?
>
> If it does attach to C volume, you must store the volume pointer somewhere
> during OnInstanceSetup callback so that you can you it later.
>
> If it doesn’t attach to C volume, so you’d not see any recursive call on
> using ZwCreateFile, that’s why I suspect you are attaching to all your
> volumes.
>
> Regards,
> –
> Fernando Roberto da Silva
> DriverEntry Kernel Development
> http://www.driverentry.com.br
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
fantastic , thank
On Mon, Dec 22, 2014 at 10:29 PM, wrote:
> First you use the FltGetVolumeFromName to get the volume pointer, then you
> can use FltGetVolumeInstanceFromName to get your instance on that volume.
>
> Regards,
> –
> Fernando Roberto da Silva
> DriverEntry Kernel Development
> http://www.driverentry.com.br
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>