Hi,
I am developing a File System Filter Driver. I want to use a reparse point that I ill set on files to indicate that certain processing should take place for these files. I plan to use the data buffer in the Reparse point to indicate a number of different options for the processing - but I can’t set the reparse point.
I have been struggling for a long time to understand the process. From what I can make out I need to register a GUID for my driver, and specify the same GUID in the ReparsePoint when I assign the tag. I don’t know how to do this. I had thought I had cracked it wtih a call to IoRegisterDeviceInterface but I don’t appear to have the Interface registered (I had expected to see it in the registry and it’s not there so I guess I’ve not done this correctly).
The code that (attempts to) register the interface is in the DriverEntry routine (derived from sfilter) as follows:
//
// Create the Control Device Object (CDO). This object represents this
// driver. Note that it does not have a device extension.
//
RtlInitUnicodeString( &nameString, L"\FileSystem\Filters\AHFSFilter" );
status = IoCreateDevice( DriverObject, 0, &nameString, FILE_DEVICE_DISK_FILE_SYSTEM,
FILE_DEVICE_SECURE_OPEN, FALSE, &gSFilterControlDeviceObject );
if (status == STATUS_OBJECT_PATH_NOT_FOUND)
{
//
// This must be a version of the OS that doesn’t have the Filters
// path in its namespace. This was added in Windows XP.
//
// We will try just putting our control device object in the \FileSystem
// portion of the object name space.
//
RtlInitUnicodeString( &nameString, L"\FileSystem\AHFSFilterCDO" );
status = IoCreateDevice( DriverObject, 0, &nameString, FILE_DEVICE_DISK_FILE_SYSTEM,
FILE_DEVICE_SECURE_OPEN, FALSE, &gSFilterControlDeviceObject );
if (!NT_SUCCESS( status ))
{
KdPrint(( “AHFSFilter!DriverEntry: Error creating control device object "%wZ", status=%08x\n”, &nameString, status ));
return status;
}
} else if (!NT_SUCCESS( status )) {
KdPrint(( “AHFSFilter!DriverEntry: Error creating control device object "%wZ", status=%08x\n”, &nameString, status ));
return status;
}
// !NB! RJL - Register the Interface Class for our Reparse Points …
//
if(NT_SUCCESS(IoRegisterDeviceInterface( DriverObject->DeviceObject,
&GUID_AHFS_REPARSE_POINT, NULL, &uszSymbolicLinkName)))
{
RtlFreeUnicodeString(&uszSymbolicLinkName);
}
else
{
KdPrint(( “AHFSFilter!DriverEntry: Error Registering Drevice Interface Class for GUID_AHFS_REPARSE_POINT, status=%08x\n”, status ));
}
I have not created a new device object, I was hoping to have the calls come through the same driver object. Is this possible? Sensible?
When I try setting the Reparse Point on a file I get error 4392 - which indicates that I have a problem with the structure. I call the function as follows:
hFile=CreateFile(pFile, GENERIC_READ | GENERIC_WRITE ,
0,
0,
OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT,
NULL);
if(hFile!=INVALID_HANDLE_VALUE)
{
buffer.ReparseTag=0x00000080;
buffer.ReparseDataLength=0;
buffer.Reserved=0;
buffer.ReparseGuid.Data1=0x23faa677;
buffer.ReparseGuid.Data2=0x3010;
buffer.ReparseGuid.Data3=0x4487;
buffer.ReparseGuid.Data4[0]=0x9f;
buffer.ReparseGuid.Data4[1]=0x82;
buffer.ReparseGuid.Data4[2]=0x5a;
buffer.ReparseGuid.Data4[3]=0xc0;
buffer.ReparseGuid.Data4[4]=0x3c;
buffer.ReparseGuid.Data4[5]=0xfe;
buffer.ReparseGuid.Data4[6]=0x5f;
buffer.ReparseGuid.Data4[7]=0x0b;
bResult = DeviceIoControl(hFile, FSCTL_SET_REPARSE_POINT, &buffer, sizeof(REPARSE_GUID_DATA_BUFFER),
NULL, 0, &dwRetBytes, NULL);
if(!bResult)
{
dwRetBytes=GetLastError();
printf (“Could not set Reparse Point for file %s - error is %d\n”, pFile, dwRetBytes);
}
CloseHandle(hFile);
Do I need to include a data buffer, or is it failing because the GUID is not registered?
Note that we have not applied for a Reparse Tag from MS yet - this is (obviously) very early days for the project and it may get canned. We are using a value of 0x00000080 for our tag as you can see above.
So: I want to intercept a reparse point set on files -
- how do I set the point and register the driver to receive the tag?
(I can look at every CREATE that comes down, which is what my code is expecting to do at the moment, but if I can’t set the point it won’t help me.) - How does the Filter get called for a reparse point - is it on an interface that solely deals with the RP files, and if so, how do I set this up ?
Thanks in anticipation of your response.
Rob Lambden
PS: Sorry if the convention for this list is plain text only - let me know and I’ll ensure I stick to it!