Reading files opened exclusively

NTFSD
21

Believe it or not, Neal Christiansen replied this evening and I just got an
email welcoming me to the program. He said I’ll have the software early
next week. I’m quite surprised at the quick service.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> If you are signed up, there will be a section entitled “You are enrolled
> in
> the Following Beta Programs” and, below that, there should be a link to
> the
> Filter Manager.
>
> I’d be surprised if it’s there yet. It took me almost 2 weeks to convince
> them I bought the IFS, and they themselves say that it takes at least 24
> hours:
>
> “If you have received an email welcoming you to a program and you do not
> see
> the program listed below, please wait 24 hours and try again.”
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Tuesday, March 15, 2005 6:54 PM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>
> Thanks again. The site says I am signed up for the Beta program. I guess
> it automatically recognized my purchase of the IFS kit. Now I just need
> to
> figure out how to download it. That isn’t mentioned anywhere on the site
> at
>
> all.
>
> “Ken Cross” wrote in message news:xxxxx@ntfsd…
>> You have to sign up for the beta test. From a post from Molly Brown:
>>
>> “A new version of the IFSKit has been posted on betaplace. This contains
>> the latest version of the kit and an update to the filter manager. This
>> is a little newer then the kit that was given at the December PlugFest.
>>
>> Go to: http://beta.microsoft.com
>>
>> If you are not currently registered for the beta go to the above link
>> and give a Guest ID of: Filtermgr
>>
>> The only prerequisite is that you have previously purchased an IFSKit
>> (any version).”
>>
>>
>> HTH,
>> Ken
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>> Sent: Tuesday, March 15, 2005 2:49 PM
>> To: Windows File Systems Devs Interest List
>> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>>
>> Where is the best place to read up on mini-filters? I see mentions of
>> them
>> in passing but I’ve never seen a comprehensive description anywhere.
>>
>> “Ken Cross” wrote in message news:xxxxx@ntfsd…
>>> If you decide to take that path, consider using Filter Manager
>>> (minifilters)
>>> which is a major reason for the update.
>>>
>>> Almost everything is easier, such as filename retrieval, file I/O, and
>>> context tracking. Also, the final released forms of minifilters are
>>> loadable/unloadable on running systems without reboots (yea!).
>>>
>>> I had a fully operational legacy filter driver and threw it out in favor
>>> of
>>> writing a minifilter from scratch and am extremely glad I did.
>>>
>>> Just my $0.02…
>>>
>>> Ken
>>>
>>>
>>> -----Original Message-----
>>> From: xxxxx@lists.osr.com
>>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>>> Sent: Tuesday, March 15, 2005 2:24 PM
>>> To: Windows File Systems Devs Interest List
>>> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>>>
>>> Thanks. Now I have to make the big decision whether to trust Microsoft
>>> with
>>>
>>> something this important to my product.
>>>
>>> “Randy Cook” wrote in message news:xxxxx@ntfsd…
>>>> Neal says by the middle of the year.
>>>>
>>>> — Mark Hahn wrote:
>>>>>
>>>>> That would be great. Any idea when this would be
>>>>> released?
>>>>>
>>>>
>>>>
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

22

You shouldn’t be surprised. The filter manager team at Microsoft has
been spectacularly good at supporting the community - Neal and Molly
routinely answer questions in-forum. The team is quite open to
suggestions for improvements, comments, and enhancements.

That’s one true advantage of having the DEVs participate in this forum.
At the same time, it also underscores our need to ensure the questions
and feedback from this group are as good as possible - so they know we
respect and value their time and attention.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, March 16, 2005 12:23 AM
To: ntfsd redirect
Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively

Believe it or not, Neal Christiansen replied this evening and I just got
an
email welcoming me to the program. He said I’ll have the software early

next week. I’m quite surprised at the quick service.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> If you are signed up, there will be a section entitled “You are
enrolled
> in
> the Following Beta Programs” and, below that, there should be a link
to
> the
> Filter Manager.
>
> I’d be surprised if it’s there yet. It took me almost 2 weeks to
convince
> them I bought the IFS, and they themselves say that it takes at least
24
> hours:
>
> “If you have received an email welcoming you to a program and you do
not
> see
> the program listed below, please wait 24 hours and try again.”
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Tuesday, March 15, 2005 6:54 PM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>
> Thanks again. The site says I am signed up for the Beta program. I
guess
> it automatically recognized my purchase of the IFS kit. Now I just
need
> to
> figure out how to download it. That isn’t mentioned anywhere on the
site
> at
>
> all.
>
> “Ken Cross” wrote in message news:xxxxx@ntfsd…
>> You have to sign up for the beta test. From a post from Molly Brown:
>>
>> “A new version of the IFSKit has been posted on betaplace. This
contains
>> the latest version of the kit and an update to the filter manager.
This
>> is a little newer then the kit that was given at the December
PlugFest.
>>
>> Go to: http://beta.microsoft.com
>>
>> If you are not currently registered for the beta go to the above link
>> and give a Guest ID of: Filtermgr
>>
>> The only prerequisite is that you have previously purchased an IFSKit
>> (any version).”
>>
>>
>> HTH,
>> Ken
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>> Sent: Tuesday, March 15, 2005 2:49 PM
>> To: Windows File Systems Devs Interest List
>> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>>
>> Where is the best place to read up on mini-filters? I see mentions
of
>> them
>> in passing but I’ve never seen a comprehensive description anywhere.
>>
>> “Ken Cross” wrote in message
news:xxxxx@ntfsd…
>>> If you decide to take that path, consider using Filter Manager
>>> (minifilters)
>>> which is a major reason for the update.
>>>
>>> Almost everything is easier, such as filename retrieval, file I/O,
and
>>> context tracking. Also, the final released forms of minifilters are
>>> loadable/unloadable on running systems without reboots (yea!).
>>>
>>> I had a fully operational legacy filter driver and threw it out in
favor
>>> of
>>> writing a minifilter from scratch and am extremely glad I did.
>>>
>>> Just my $0.02…
>>>
>>> Ken
>>>
>>>
>>> -----Original Message-----
>>> From: xxxxx@lists.osr.com
>>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>>> Sent: Tuesday, March 15, 2005 2:24 PM
>>> To: Windows File Systems Devs Interest List
>>> Subject: Re:[ntfsd] Re:Re:Reading files opened exclusively
>>>
>>> Thanks. Now I have to make the big decision whether to trust
Microsoft
>>> with
>>>
>>> something this important to my product.
>>>
>>> “Randy Cook” wrote in message
news:xxxxx@ntfsd…
>>>> Neal says by the middle of the year.
>>>>
>>>> — Mark Hahn wrote:
>>>>>
>>>>> That would be great. Any idea when this would be
>>>>> released?
>>>>>
>>>>
>>>>
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

23

I use the similar code in my filter driver and it works fine for all files except some files critical to NTFS and OS, including:
$boot, pagefile.sys, $logfile, $bitmap and some others. I suppose you can’t open hiberfil.sys because of the same restrictions.

I tried to intercept file objects for such files and perform operations on them, but it seems some operations are forbidden for such files, in particular
FSCTL_GET_RETRIEVAL_POINTERS doesn’t work for them. I didn’t try IRP_MJ_READ on them however.

–
Roman

“Mark Hahn” ???/??? ? ??? ???: news:xxxxx@ntfsd…
> “Lyndon J Clarke” wrote …
>
> > How about. ZwCreateFile for SYNCHRONIZE, and roll your own IRP_MJ_READ?
>
> I tried that with no luck. My ZwCreateFile is returning “A file cannot be
> opened because the share access flags are incompatible.” Maybe my
> ZwCreateFile is set up wrong. Could you take a look at my code?
>
> UNICODE_STRING path;
> OBJECT_ATTRIBUTES fileAttributes;
> HANDLE fileHandle;
>
> Path = L"\DosDevices\D:\hiberfil.sys";
> path.Length = wcslen(Path) * sizeof(WCHAR);
> path.MaximumLength = path.Length;
> path.Buffer = Path;
>
> InitializeObjectAttributes( &fileAttributes, &path, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL, NULL );
>
> status = ZwCreateFile( &fileHandle, SYNCHRONIZE, &fileAttributes, &ioStatus,
> NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE |
> FILE_SHARE_DELETE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 );
>
>
>

24

That is correct. A beta copy of the W2K Security Rollup is available
today.

Go to: http://beta.microsoft.com
GuestID: Win2kURPTest

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Tuesday, March 15, 2005 7:25 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Re:Reading files opened exclusively

Neal says by the middle of the year.

— Mark Hahn wrote:
>
> That would be great. Any idea when this would be
> released?
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com