SRV again

NTFSD
1

I DONT KNOW WHY THE LIST SERVER IS REEJCTING THE MAILS!@!!!

Dear All,

I am working on this FS filter. As someone pointed out , the calls to the
server component of Lanman bypasses NtCreateFile( ) and friends. I did this
simple experiment.

On a machine I set up kernel debugging, and set a break point on NtCreate
using the following command.

bp ntcreatefile “.echo file; dt _object_attributes poi(esp+0c); g”

This was good enough to give me the filename for NtCreate call in kernel
mode.

Now On the same machine I created a shared folder using windows File
sharing. I also added some files in the folder.

Now from another machine, I accessed these files using \<shared>dir>

I opened a file remotely using notepad.

None of these got recorded in the debugger.

I think this is proof enough that for network shares NtCreate( ) and fiends
are bypassed. Or dis I go for a wild goose chase?

Now, in my current project, I need to generate logs of file IO. I need to
log these requests, and the hooking approach is not recommended, and also
fails when these network reads occur ( the proof was the experiment I did).

But exactly how this happens is unclear to me. I will try to explain.

machine A has a share called \<share><br>
it has the files a.txt, b.txt and c.txt

Machine B accesses the share and reads the files.

Now is it correct to state, that

1. if my driver doesn’t attach itself to LanmanRedirector, and is loaded
Machine B (which reads the share) then I will not get any logs ??
2. On machine A (which has the share) if my driver is loaded, I will get
normal IRPs which an FS expects for file reads?

If the above two are true, can someone take some time and explain as to why
i won’t get NTCreate( ) calls on machine A? Where exactly does the server
component tap the IO manager. if I know correctly, NtCreate( ) and freinds
are implemented in the NtExecutive. Does this mean that the server service
bypasses the executive also?

Please clarify.

Fervently hoping to get a relpy from you…

Regards,

amitr0
–

- amitr0

2

  1. NtCreateFile is not the only way to create/open a file. e.g. See
    IoCreateFile in DDK docs.

  2. The only extension model that exists and guarantees that you see all I/O
    is attaching to the FS stack as a filter.

  3. It is not just that hooking is not recommended. It is bad. (You can
    search the archives for details.)

Now, that all being said, if all that you want to do is log I/O, a file
system filter should be fairly straightforward, especially if you write a
mini-filter that uses the filter manager.

  • Danilo

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of amitr0
Sent: Monday, January 23, 2006 9:17 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] SRV again

I DONT KNOW WHY THE LIST SERVER IS REEJCTING THE MAILS!@!!!

Dear All,

I am working on this FS filter. As someone pointed out , the calls to the
server component of Lanman bypasses NtCreateFile( ) and friends. I did this
simple experiment.

On a machine I set up kernel debugging, and set a break point on NtCreate
using the following command.

bp ntcreatefile “.echo file; dt _object_attributes poi(esp+0c); g”

This was good enough to give me the filename for NtCreate call in kernel
mode.

Now On the same machine I created a shared folder using windows File
sharing. I also added some files in the folder.

Now from another machine, I accessed these files using \<shared>dir>

I opened a file remotely using notepad.

None of these got recorded in the debugger.

I think this is proof enough that for network shares NtCreate( ) and fiends
are bypassed. Or dis I go for a wild goose chase?

Now, in my current project, I need to generate logs of file IO. I need to
log these requests, and the hooking approach is not recommended, and also
fails when these network reads occur ( the proof was the experiment I did).

But exactly how this happens is unclear to me. I will try to explain.

machine A has a share called \<share><br>
it has the files a.txt, b.txt and c.txt

Machine B accesses the share and reads the files.

Now is it correct to state, that

1. if my driver doesn’t attach itself to LanmanRedirector, and is loaded
Machine B (which reads the share) then I will not get any logs ??
2. On machine A (which has the share) if my driver is loaded, I will get
normal IRPs which an FS expects for file reads?

If the above two are true, can someone take some time and explain as to why
i won’t get NTCreate( ) calls on machine A? Where exactly does the server
component tap the IO manager. if I know correctly, NtCreate( ) and freinds
are implemented in the NtExecutive. Does this mean that the server service
bypasses the executive also?

Please clarify.

Fervently hoping to get a relpy from you…

Regards,

amitr0

3

> 2) The only extension model that exists and guarantees that you see all I/O

is attaching to the FS stack as a filter.

Not really… this does not guarantee - e.g. certain AV filters were faulty,
and attached directly to the FS, thus bypassing any previously attached filters.
This is IMO an OS bug, but hey…

–
Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

4

>I am working on this FS filter. As someone pointed out , the calls to the

server component of Lanman bypasses NtCreateFile( ) and friends. I did this

Correct, they call FastIo directly, for instance, FastIoQueryOpen instead of
NtCreateFile sometimes.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

5

> >I am working on this FS filter. As someone pointed out , the calls to

>the
>server component of Lanman bypasses NtCreateFile( ) and friends. I did
>this

For example for open/create file, Srv.sys calls IoCreateFile instead
(observed on Win2003SP1)

L.