I developped a very simple minifilter on the basis of minifilter sample PassThrough.I find a problem in some WinXP SP2 evirionment(added some hotfixs),there are just only one minifilter(my minifilter) and only one legacy filter(fltmanager).And,in other WinXP SP2 evironment,there is no the problem.
I just developped my minifilter from the sample PassThrough,but added the handler:
in pre-Create,I call FltCreate(execlusively) to open the target file,and then FltClose it.
But,I observed the situation:
the call FltCreate will hanged,never return.
By my test,I have the conclusion:
If the target file have opened before this pre-Create,my FltCreate(execlusively) should be STATUS_SHARING_VIOLATION,but the FltCreate(execlusively) will hang(never returned)!
the minifilter is developped on the basis of minifilter sample PassThrough.I just modify the following:
CONST FLT_OPERATION_REGISTRATION Callbacks = {
{ IRP_MJ_CREATE,
0,
PtPreOperationCreate,
PtPostOperationCreate },
…
{ IRP_MJ_OPERATION_END }
};
FLT_PREOP_CALLBACK_STATUS
PtPreOperationCreate (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
NTSTATUS status;
BOOLEAN bTest;
OBJECT_ATTRIBUTES objectAttributes;
HANDLE hFile;
IO_STATUS_BLOCK ioStatus;
//get the filename
if (FltObjects->FileObject == NULL)
return FLT_PREOP_SUCCESS_NO_CALLBACK ;
status=FltGetFileNameInformation(Data,
FLT_FILE_NAME_NORMALIZED|FLT_FILE_NAME_QUERY_DEFAULT,
&nameInfo);
if (!NT_SUCCESS(status))
return FLT_PREOP_SUCCESS_NO_CALLBACK ;
status=FltParseFileNameInformation(nameInfo);
if (!NT_SUCCESS(status))
{
FltReleaseFileNameInformation(nameInfo);
return FLT_PREOP_SUCCESS_NO_CALLBACK ;
}
//I just test the files have the specific extension
bTest=CheckExtension( &nameInfo->Extension );
if (!bTest)
{
FltReleaseFileNameInformation(nameInfo);
return FLT_PREOP_SUCCESS_NO_CALLBACK ;
}
KdPrint((“\r\nTest Create File:%wZ”,&nameInfo->Name));
//issue my fltcreate
InitializeObjectAttributes( &objectAttributes,
&nameInfo->Name,
OBJ_KERNEL_HANDLE,
NULL,
NULL );
status=FltCreateFile(gFilterHandle,
FltObjects->Instance,
&hFile,
GENERIC_READ,
&objectAttributes,
&ioStatus,
(PLARGE_INTEGER) NULL,
FILE_ATTRIBUTE_NORMAL,
0,//execlusively
FILE_OPEN,
0L,
NULL,
0L,
0 );
KdPrint((“\r\nTest File:%wZ,Status:%x”,&nameInfo->Name,status));
if (NT_SUCCESS( status ))
{
FltClose(hFile);
}
FltReleaseFileNameInformation( nameInfo );
return FLT_PREOP_SUCCESS_WITH_CALLBACK ;
}
FLT_POSTOP_CALLBACK_STATUS
PtPostOperationCreate (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__in_opt PVOID CompletionContext,
__in FLT_POST_OPERATION_FLAGS Flags
)
{
return FLT_POSTOP_FINISHED_PROCESSING;
}
//
// This is a static list of file name extensions files we are interested in testing
//
const UNICODE_STRING ExtensionsToTest =
{RTL_CONSTANT_STRING( L"txt"),
{0, 0, NULL}
};
BOOLEAN
CheckExtension (
__in PUNICODE_STRING Extension
)
/*++
Routine Description:
Checks if this file name extension is something we are interested in
–*/
{
const UNICODE_STRING *ext;
if (Extension->Length == 0) {
return FALSE;
}
//
// Check if it matches any one of our static extension list
//
ext = ExtensionsToTest;
while (ext->Buffer != NULL) {
if (RtlCompareUnicodeString( Extension, ext, TRUE ) == 0) {
//
// A match. We are interested in this file
//
return TRUE;
}
ext++;
}
return FALSE;
}
Anybody can clear it?Thank you very much!
