same FILE_OBJECT pointer in IRP_MJ_CREATE & IPR_MJ_WRITE ?

NTFSD
1

Hi all,

Is the same FILE_OBJECT pointer in IRP_MJ_CREATE are used in IRP_MJ_WRITE ? If no , how can i do the following ?

In IRP_MJ_WRITE i need to take a complete back of the file which is going to be changed.

Currently, i started it - In IRP_MJ_CREATE dispatcher i stored all the FILE_OBJECT pointer with the corresponding file name . In the IRP_MJ_WRITE i am matching the current FILE_OBJECT pointer with the stored list of FILE_OBJECT pointer. So that i can able to get the file name in the IRP_MJ_WRITE. After this i have to allocate one new IRP which has to take a complete copy of the file .

Am i going in a right direction?
Any help or suggestions would be most appreciated.

thanks,
Solomon.A

Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE!
http://in.mail.yahoo.com

2

No.
They may differ if the file has been mapped in memory. You can see Paging Irp with the file object which is backing for section. You can see more than one FILE_OBJECT in IRP_MJ_CREATE requests but only one file object in IRP_MJ_WRITE .
“Solomon Anand” wrote in message news:xxxxx@ntfsd…
Hi all,

Is the same FILE_OBJECT pointer in IRP_MJ_CREATE are used in IRP_MJ_WRITE ? If no , how can i do the following ?

In IRP_MJ_WRITE i need to take a complete back of the file which is going to be changed.

Currently, i started it - In IRP_MJ_CREATE dispatcher i stored all the FILE_OBJECT pointer with the corresponding file name . In the IRP_MJ_WRITE i am matching the current FILE_OBJECT pointer with the stored list of FILE_OBJECT pointer. So that i can able to get the file name in the IRP_MJ_WRITE. After this i have to allocate one new IRP which has to take a complete copy of the file .

Am i going in a right direction?
Any help or suggestions would be most appreciated.

thanks,
Solomon.A

------------------------------------------------------------------------------
Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE!
http://in.mail.yahoo.com

3

You will see paging IRP_MJ_WRITE with other file objects. Here are three tips which you might find useful.

1: FileObject->FsContext and the osr nt insider article on reference counting and tracking state.
2: XP[+] filter contexts.
3: filter manager.

Solomon Anand" wrote in message news:xxxxx@ntfsd…
Hi all,

Is the same FILE_OBJECT pointer in IRP_MJ_CREATE are used in IRP_MJ_WRITE ? If no , how can i do the following ?

In IRP_MJ_WRITE i need to take a complete back of the file which is going to be changed.

Currently, i started it - In IRP_MJ_CREATE dispatcher i stored all the FILE_OBJECT pointer with the corresponding file name . In the IRP_MJ_WRITE i am matching the current FILE_OBJECT pointer with the stored list of FILE_OBJECT pointer. So that i can able to get the file name in the IRP_MJ_WRITE. After this i have to allocate one new IRP which has to take a complete copy of the file .

Am i going in a right direction?
Any help or suggestions would be most appreciated.

thanks,
Solomon.A

------------------------------------------------------------------------------
Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE!
http://in.mail.yahoo.com