SRV bypassing the FS filter driver.

NTFSD
1

Hi All,

I have a FS filter driver that does some processing on the data that is being read. If an executable is run through a network share what I see is SRV requests only for first 1k block & rest of the reads are bypassed & probably directly read through NTFS.

Is there any way I could see these request? hooking NTFS IRP handlers looks one obvious but probably not suitable for a production driver. Is there any registry entry or something that I can use to turn off these SRV optimizations?

thanks,
Rushi.

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

2

Is this a legacy filter or a mini-filter? I’m guessing legacy

SRV uses fast I/O routines for much of its I/O (via the MDL interface).
If you wish to “disable” this you need merely return FALSE to those fast
I/O entry points.

Note that SRV also *caches* those entry points (it copies the function
pointers) so you will also miss I/O for files that were opened prior to
your filter being loaded. It is another reason why legacy filters are
also not unloadable.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rushi
Sent: Friday, September 23, 2005 3:30 PM
To: ntfsd redirect
Subject: [ntfsd] SRV bypassing the FS filter driver.

Hi All,

I have a FS filter driver that does some processing on the data that is
being read. If an executable is run through a network share what I see
is SRV requests only for first 1k block & rest of the reads are bypassed
& probably directly read through NTFS.

Is there any way I could see these request? hooking NTFS IRP handlers
looks one obvious but probably not suitable for a production driver. Is
there any registry entry or something that I can use to turn off these
SRV optimizations?

thanks,
Rushi.

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed
to ntfsd as: xxxxx@osr.com To unsubscribe send a blank email to
xxxxx@lists.osr.com