I don’t want this to happen, as you can see I call the IoDeleteDevice()
not because the fsd IoDeleteDevice get called , it means when ever I
delete all the filters above me get called and delete .
Is there any way like from my detech/delete routine to make a bound
between the deviceObcect below me(devobj->DevExt->filesystem/NextDevice)
and the one that is above me(devobj->AttachedDevice).( known that after
I’ll call IoDeleteDevice()those above me will also get called ).
forgive me if that’s doesn’t sounds reasonable .
Tony Mason wrote:
When you call IoDeleteDevice, the I/O Manager notices that filespy is
attached to your device object and calls its fast I/O detach device entry
point.This is exactly the same reason your detach device entry point is called
(when the FSD on which you are filtering deletes its own device object.)Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com-----Original Message-----
From: Danny [mailto:xxxxx@neptune.co.il]
Sent: Wednesday, August 22, 2001 6:02 PM
To: File Systems Developers
Subject: [ntfsd] why filespy detach after my filesystem filter DeviceObject
detach ?Hi All,
Could any one tell me why this is happening to me:
every time I ask filespy to filter the same partition which I am also
Attached to ,when I eventually detach/delete from it the
FilespyFastIoDetachDevice get Invoked by the system (see the call stack
and code below).
Thanks,
Daniel.my dynamic unhook:
MyDeviceExtension = MyDeviceObjectsL[Drive]->DeviceExtension;
IoDetachDevice(My DeviceExtension->FileSystem );
IoDeleteDevice( MyDeviceObjectsL[Drive] );
MyDeviceObjectsL[Drive] = NULL;
}
return TRUE;
fileSpy code:
SpyFastIoDetachDevice( IN PDEVICE_OBJECT SourceDevice, IN
PDEVICE_OBJECT TargetDevice)
{
PRECORD_LIST recordList;
BOOLEAN shouldLog;
PDEVICE_EXTENSION devext;PAGED_CODE();
devext = SourceDevice->DeviceExtension;
ASSERT(devext->Type == FILESPY_DEVICE_TYPE);ExAcquireFastMutex( &gSpyDeviceExtensionListLock );
RemoveEntryList(&devext->NextDevice); // remove from LOG list
ExReleaseFastMutex( &gSpyDeviceExtensionListLock );
…
// Detach from the file system’s volume device object.IoDetachDevice( TargetDevice );
IoDeleteDevice( SourceDevice );}
call stack:
FramePtr RetAddr Param1 Param2 Param3 Function Name
f3206d2c 80114558 809a1e60 808f5260 808f5260
FILESPY!SpyFastIoDetachDevice (EBP) [filespy.c @ 2080]
f3206d78 80111ee8 808f5260 00000000 f3f23650 NT!KeDetachProcess+0xa6
(FPO: [ebp f3206db0] [0,1,4])
f3206d8c f3f21706 808f5260 808f5318 808f5260
NT!IoSetThreadHardErrorMode+0x1a (FPO: [1,0,1])
f3206db8 f3f225c9 00000000 80ad0cf0 f3f23650
MYFILTER!MyDetachDevice+0x80 (EBP) [clearmp.c @ 772]
f3206e0c 8016f29e 80a50aa8 00000001 00000000
MYFILTER!MyFfilterFastIoDeviceControl+0x138 (EBP) [clearmp.c @ 1385]
f3206ea0 80169a30 00000158 00000000 00000000
NT!IopCreateMadeupNode+0x1f0 (EBP)
f3206ed4 8013dde4 00000158 00000000 00000000
NT!BuildQueryDirectoryIrp+0x440 (EBP)
f3206f04 00000000 00000000 00000000 00000000
NT!V86CriticalInstruction+0x307 (No FPO)
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@neptune.co.il
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com