STATUS_REPARSE and NTFS

By manipulating irps
(IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
tell NT that a file (C:\NOTEPAD.EXE) exists. It is
not really there.

When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE, I
redirect (C:\REDIR\NOTEPAD.EXE) it using
STATUS_REPARSE.

This works great on a FAT partition. I see an open
request to get the icon and launching the app works
fine.

When I try this on a NTFS partition I get a “Program
Not Found” “Windows cannot find NOTEPAD.EXE” when
trying to launch the app.

Explorer does manage to get the icon for notepad even
though I don’t see any IRP_MJ_CREATE requests for
C:\NOTEPAD.EXE.

When I attempt to launch notepad, I see several
IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I redirect
all of these using STATUS_REPARSE. All of these
redirected requests complete with 0.

I also see many IRP_MJ_CREATE requests trying to open
NTFS streams on C:\NOTEPAD.EXE. I also redirect
these.

Looking through the archive of this list I see that
there are some functions (IoCreateStreamFileObject,
IoCreateStreamFileObjectLite) that can be used to get
a file object bypassing the normal irp mechanism.

My redirect algorithm is like this:

If the FileObject->FileName buffer is too small for
the new path, free the buffer (if != NULL), and
ExAllocatePoolWithTag a new buffer.

Put the redirect string into FileObject->FileName.

Irp->IoStatus.Information = IO_REPARSE;
Irp->IoStatus.Status = STATUS_REPARSE;

IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_REPARSE;

If anyone can shed some light on this it would be much
appreciated. Thanks.

Randy Cook
Lucid Systems Inc.


Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

Are you checking for a related file object?

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Thursday, October 31, 2002 10:42 AM
To: File Systems Developers
Subject: [ntfsd] STATUS_REPARSE and NTFS

By manipulating irps
(IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
tell NT that a file (C:\NOTEPAD.EXE) exists. It is
not really there.

When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE, I
redirect (C:\REDIR\NOTEPAD.EXE) it using
STATUS_REPARSE.

This works great on a FAT partition. I see an open
request to get the icon and launching the app works
fine.

When I try this on a NTFS partition I get a “Program
Not Found” “Windows cannot find NOTEPAD.EXE” when
trying to launch the app.

Explorer does manage to get the icon for notepad even
though I don’t see any IRP_MJ_CREATE requests for
C:\NOTEPAD.EXE.

When I attempt to launch notepad, I see several
IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I redirect
all of these using STATUS_REPARSE. All of these
redirected requests complete with 0.

I also see many IRP_MJ_CREATE requests trying to open
NTFS streams on C:\NOTEPAD.EXE. I also redirect
these.

Looking through the archive of this list I see that
there are some functions (IoCreateStreamFileObject,
IoCreateStreamFileObjectLite) that can be used to get
a file object bypassing the normal irp mechanism.

My redirect algorithm is like this:

If the FileObject->FileName buffer is too small for
the new path, free the buffer (if != NULL), and
ExAllocatePoolWithTag a new buffer.

Put the redirect string into FileObject->FileName.

Irp->IoStatus.Information = IO_REPARSE;
Irp->IoStatus.Status = STATUS_REPARSE;

IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_REPARSE;

If anyone can shed some light on this it would be much
appreciated. Thanks.

Randy Cook
Lucid Systems Inc.


Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

Hi Jamey,

I assume you mean using the related file object to
properly determine the full path to the file?

Yes I do.

The fact that I’ve seen so many questions about
redirecting on this list and no complaints about NTFS
leads me to believe that this is a problem in my code.
But, I can think of a couple of things that may be
different about what I’m doing: 1) the original file
doesn’t really exist, 2) it is an executable file.

Have others been able to get this to work?

Thanks,

— Jamey Kirby wrote:
> Are you checking for a related file object?
>
> Jamey
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Randy Cook
> Sent: Thursday, October 31, 2002 10:42 AM
> To: File Systems Developers
> Subject: [ntfsd] STATUS_REPARSE and NTFS
>
> By manipulating irps
> (IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY) I
> tell NT that a file (C:\NOTEPAD.EXE) exists. It is
> not really there.
>
> When a IRP_MJ_CREATE comes along for C:\NOTEPAD.EXE,
> I
> redirect (C:\REDIR\NOTEPAD.EXE) it using
> STATUS_REPARSE.
>
> This works great on a FAT partition. I see an open
> request to get the icon and launching the app works
> fine.
>
> When I try this on a NTFS partition I get a “Program
> Not Found” “Windows cannot find NOTEPAD.EXE” when
> trying to launch the app.
>
> Explorer does manage to get the icon for notepad
> even
> though I don’t see any IRP_MJ_CREATE requests for
> C:\NOTEPAD.EXE.
>
> When I attempt to launch notepad, I see several
> IRP_MJ_CREATE requests for C:\NOTEPAD.EXE. I
> redirect
> all of these using STATUS_REPARSE. All of these
> redirected requests complete with 0.
>
> I also see many IRP_MJ_CREATE requests trying to
> open
> NTFS streams on C:\NOTEPAD.EXE. I also redirect
> these.
>
> Looking through the archive of this list I see that
> there are some functions (IoCreateStreamFileObject,
> IoCreateStreamFileObjectLite) that can be used to
> get
> a file object bypassing the normal irp mechanism.
>
> My redirect algorithm is like this:
>
> If the FileObject->FileName buffer is too small for
> the new path, free the buffer (if != NULL), and
> ExAllocatePoolWithTag a new buffer.
>
> Put the redirect string into FileObject->FileName.
>
> Irp->IoStatus.Information = IO_REPARSE;
> Irp->IoStatus.Status = STATUS_REPARSE;
>
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> return STATUS_REPARSE;
>
>
> If anyone can shed some light on this it would be
> much
> appreciated. Thanks.
>
> Randy Cook
> Lucid Systems Inc.
>
>
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%


Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/