Wangkaig,
I am a beginner DDK programmer, so all my answers might not be correct, but
let me try.
“I have a question that i want to bypass all of filesystem filter drivers to
read data of my specific file by building own IRP.”
When you build your own IRP to read the file, you will need a FileObject
first. Uae ZwCreateFile to open a file in Kernel and then get it’s
FileObject by ObReferenceObjectByHandle API. Remember to set AccessMode to
KernelMode.
“But it would failed because i haven’t right to read”
I don’t understand why you won’t have the right to read though.
Well, after you got the Fo, and you build the IRP, you can definitely call
the Fsd directly bypassing all other filters, by IoCallDriver(
fsdDevice, irp);
Where fsdDevice can be set to
PDEVICE_OBJECT fsdDevice = IoGetRelatedDeviceObject(FileObject);
and
irp = IoAllocateIrp(fsdDevice->StackSize, FALSE);
This might not be strictly legal, but it would bypass all filters above teh
FS.
Experts, please correct me if I am mistaken.
amitr0
On 6/8/06, xxxxx@lenovo.com wrote:
>
>
> Hello everybody,
>
> I have a question that i want to bypass all of filesystem filter drivers
> to read data of my specific file by building own IRP.For example,i want to
> read a exclusive file by building own IRP.But it would failed because i
> haven’t right to read.Now i can send IRP correctly to Storage Device
> Object but it is not my want the data.If i send the IRP to my filter
> driver attached device can only read in-exlusive file.How can i do that
> send my IRP to relative device object in order to read the exclusive file?
>
> Any help is highly appriciated.Thanks
>
> Ken — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: xxxxx@gmail.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
–
- amitr0