STATUS_REPARSE in IRP_MJ_WRITE

NTFSD
1

Hi all,
I want to do the following functiality.
A specific volume is protected say, C:\ now if I do any changes files of
C Drive then another file is created in D: and the changes occur there.
e.g. if I modify C:\EXE\this.txt then a new file D:\1.txt is opened which
will be having the contents of C:\EXE\this.txt and all the modification
done on C:\EXE\this.txt are actually taking place in D:\1.txt keeping
files of C: intact.
Now I am doing it this way. If for C: I get IRP_MJ_WRITE then I know that
some modification is to be done in C: drive’s file , here I am doing
STATUS_REPARSE to point to a newly created file(by ZwCreateFile) in D
Drive. Now all the data submitted in IRP_MJ_WRITE should actually go in D:
as I have reparsed the C: drives file. But this is not the case. I get the
empty file created in D drive and whatever I am writing in C: drives file
are actually getting erased. Can anybody tell the reason.
Should I handle it some other way.
Thanks
Lalit.

2

STATUS_REPARSE works only for IRP_MJ_CREATE. When you get IRP_MJ_WRITE for
your C: disk, you must call ZwWriteFile for according file on drive D: and
complete original WRITE IRP with status returned by ZwWriteFile. That’s it.

-htfv

----- Original Message -----
From: “Lalit S. Rana”
To: “File Systems Developers”
Sent: Friday, June 06, 2003 2:41 PM
Subject: [ntfsd] STATUS_REPARSE in IRP_MJ_WRITE

> Hi all,
> I want to do the following functiality.
> A specific volume is protected say, C:\ now if I do any changes files of
> C Drive then another file is created in D: and the changes occur there.
> e.g. if I modify C:\EXE\this.txt then a new file D:\1.txt is opened which
> will be having the contents of C:\EXE\this.txt and all the modification
> done on C:\EXE\this.txt are actually taking place in D:\1.txt keeping
> files of C: intact.
> Now I am doing it this way. If for C: I get IRP_MJ_WRITE then I know that
> some modification is to be done in C: drive’s file , here I am doing
> STATUS_REPARSE to point to a newly created file(by ZwCreateFile) in D
> Drive. Now all the data submitted in IRP_MJ_WRITE should actually go in D:
> as I have reparsed the C: drives file. But this is not the case. I get the
> empty file created in D drive and whatever I am writing in C: drives file
> are actually getting erased. Can anybody tell the reason.
> Should I handle it some other way.
> Thanks
> Lalit.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

Not for sure, but doesn’t STATUS_REPARSE only work for IRP_MJ_CREATE?

----- Original Message -----
From: “Lalit S. Rana”
To: “File Systems Developers”
Sent: Friday, June 06, 2003 1:41 PM
Subject: [ntfsd] STATUS_REPARSE in IRP_MJ_WRITE

> Hi all,
> I want to do the following functiality.
> A specific volume is protected say, C:\ now if I do any changes files of
> C Drive then another file is created in D: and the changes occur there.
> e.g. if I modify C:\EXE\this.txt then a new file D:\1.txt is opened which
> will be having the contents of C:\EXE\this.txt and all the modification
> done on C:\EXE\this.txt are actually taking place in D:\1.txt keeping
> files of C: intact.
> Now I am doing it this way. If for C: I get IRP_MJ_WRITE then I know that
> some modification is to be done in C: drive’s file , here I am doing
> STATUS_REPARSE to point to a newly created file(by ZwCreateFile) in D
> Drive. Now all the data submitted in IRP_MJ_WRITE should actually go in D:
> as I have reparsed the C: drives file. But this is not the case. I get the
> empty file created in D drive and whatever I am writing in C: drives file
> are actually getting erased. Can anybody tell the reason.
> Should I handle it some other way.
> Thanks
> Lalit.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thanks Alexey Logachyov,
I get your solution, but I need to ask you how can i get the device object
for E: drive when the IRP is for C: Drive.
Thanks in advance,
Lalit.

5

Use IoGetDeviceObjectPointer with L"E:" as ObjectName.

-htfv

----- Original Message -----
From: “Lalit S. Rana”
To: “File Systems Developers”
Sent: Friday, June 06, 2003 8:42 PM
Subject: [ntfsd] Re: STATUS_REPARSE in IRP_MJ_WRITE

> Thanks Alexey Logachyov,
> I get your solution, but I need to ask you how can i get the device object
> for E: drive when the IRP is for C: Drive.
> Thanks in advance,
> Lalit.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

6

“Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
>
> STATUS_REPARSE works only for IRP_MJ_CREATE. When you get IRP_MJ_WRITE for
> your C: disk, you must call ZwWriteFile for according file on drive D: and
> complete original WRITE IRP with status returned by ZwWriteFile. That’s
it.
>

There are many issues with this approach, among them:
- Zw* functions work only on PASSIVE_LEVEL while write IRP can come at
APC_LEVEL
- if it is Paging write, Zw* functions will not work reliably even on
PASSIVE_LEVEL, sometimes it will hang
- PagingIO never increases EOF while writing beyong EOF via ZwWriteFile will
increase file size
- You need to take care of FastIO

Instead of using ZwWriteData you may just set FileObject, which represents
the file to which you are redirecting data, in IO_STACK_LOCATION and send
IRP to the device where you are redirecting data. Actually if you want to
prevent data on disk from being updated while presenting updated data to
applications you need to redirect only NonPagedIO. Obviously handling Read
requests becomes quite complicated - you have to keep track of which data
were written and read either from old or new location.

Alexei.

7

Alexie,

Instead of using ZwWriteData you may just set FileObject, which represents
the file to which you are redirecting data, in IO_STACK_LOCATION and send
IRP to the device where you are redirecting data.

I wrote the following in the IRP_MJ_WRITE

RtlInitUnicodeString(&fileNameUnicodeString,L"\DosDevices\D:\BUFFER\Ray2
.txt");
IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
&FileObject,&DeviceObject);
irpStack->FileObject = FileObject;
But it says invalid handle.
How should I proceed.
Thanks
Lalit

“Alexei Jelvis” wrote in message news:xxxxx@ntfsd…
>
>
> “Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
> >
> > STATUS_REPARSE works only for IRP_MJ_CREATE. When you get IRP_MJ_WRITE
for
> > your C: disk, you must call ZwWriteFile for according file on drive D:
and
> > complete original WRITE IRP with status returned by ZwWriteFile. That’s
> it.
> >
>
> There are many issues with this approach, among them:
> - Zw* functions work only on PASSIVE_LEVEL while write IRP can come at
> APC_LEVEL
> - if it is Paging write, Zw* functions will not work reliably even on
> PASSIVE_LEVEL, sometimes it will hang
> - PagingIO never increases EOF while writing beyong EOF via ZwWriteFile
will
> increase file size
> - You need to take care of FastIO
>
> Instead of using ZwWriteData you may just set FileObject, which represents
> the file to which you are redirecting data, in IO_STACK_LOCATION and send
> IRP to the device where you are redirecting data. Actually if you want to
> prevent data on disk from being updated while presenting updated data to
> applications you need to redirect only NonPagedIO. Obviously handling Read
> requests becomes quite complicated - you have to keep track of which data
> were written and read either from old or new location.
>
> Alexei.
>
>
>
>

8

From: “Lalit Singh Rana” > I wrote the following in the
IRP_MJ_WRITE
>
>
>
RtlInitUnicodeString(&fileNameUnicodeString,L"\DosDevices\D:\BUFFER\Ray2
> .txt");
> IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
> &FileObject,&DeviceObject);
> irpStack->FileObject = FileObject;
> But it says invalid handle.

Objectname must be the name of a device, not a file.

9

> > >

> > STATUS_REPARSE works only for IRP_MJ_CREATE. When you get IRP_MJ_WRITE
for
> > your C: disk, you must call ZwWriteFile for according file on drive D:
and
> > complete original WRITE IRP with status returned by ZwWriteFile.
That’s
> it.
> >

I tried this method too, created a file and started tried writing onto the
created file but this one is also not working.

DbgPrint(“1. File Name:”);

RtlInitUnicodeString(&fileNameUnicodeString,L"\DosDevices\D:\BUFFER\Ray2
.txt");
InitializeObjectAttributes(&objectAttributes,
&fileNameUnicodeString,OBJ_CASE_INSENSITIVE, NULL, NULL );

status = ZwCreateFile ( &ntFileHandle, SYNCHRONIZE||FILE_ANY_ACCESS,
&objectAttributes, &ioStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0
);

if( !NT_SUCCESS( status ) )
DbgPrint(“ERROR :(”);
else
DbgPrint(“Success :)”);
if(Irp->UserBuffer!=NULL)
{
status=ZwWriteFile(
ntFileHandle,
NULL,
NULL,
NULL,
&ioStatus,
Irp->UserBuffer,
irpStack->Parameters.Write.Length,
&(irpStack->Parameters.Write.ByteOffset),
NULL);
DbgPrint(“From User Buffer”);
}
else if(Irp->AssociatedIrp.SystemBuffer!=NULL)
{
status=ZwWriteFile(
ntFileHandle,
NULL,
NULL,
NULL,
&ioStatus,
Irp->AssociatedIrp.SystemBuffer,
irpStack->Parameters.Write.Length,
&(irpStack->Parameters.Write.ByteOffset),
NULL);
DbgPrint(“From Associated IRP”);
}
else if(Irp->MdlAddress!=NULL)
{
status=ZwWriteFile(
ntFileHandle,
NULL,
NULL,
NULL,
&ioStatus,
MmGetSystemAddressForMdlSafe(Irp->MdlAddress,NormalPagePriority),
irpStack->Parameters.Write.Length,
&(irpStack->Parameters.Write.ByteOffset),
NULL);
DbgPrint(“From MDL Address”);
}
if(!NT_SUCCESS(ioStatus.Status))
DbgPrint(“Error in writing”);
DbgPrint(“No of bytes written %lu”, ioStatus.Information);
status = ZwClose(ntFileHandle);
//ZwMakeTemporaryObject(ntFileHandle);
if( !NT_SUCCESS( status ) )
DbgPrint(“Close ERROR :(”);
else
DbgPrint(“Close Success :)”);
return status;

This routine tells that one byte is written, but in the created file nothing
occurs.
Please Help.
Thanks
Lalit

10

Hi Tobias,
As per your advice I changed the Object Name to the device name, but it
still is not working.
The routine creates a file D:\buffer\ray2.txt but it doesn’t write anything
onto it.
Please help
I am attaching the code.
Lalit

if(SOME COMPARSION)
{
FileObject = NULL;
UNICODE_STRING myUString;

RtlInitUnicodeString(&fileNameUnicodeString,L"\??\D:\BUFFER\Ray2.txt");

//RtlAppendUnicodeStringToString(&fileNameUnicodeString,FileName);
InitializeObjectAttributes(&objectAttributes,
&fileNameUnicodeString,OBJ_CASE_INSENSITIVE, NULL, NULL );
status = ZwCreateFile ( &ntFileHandle, DELETE||FILE_GENERIC_WRITE,
&objectAttributes, &ioStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_VALID_FLAGS,
FILE_WRITE_THROUGH,//FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0
);
if( !NT_SUCCESS( status ) )
DbgPrint(“ERROR :(”);
else
DbgPrint(“Success :)”);

ZwClose(ntFileHandle);

if((fileNameUnicodeString.Length + 2) >= FileName->MaximumLength)
{
DbgPrint(“Inside”);
ExFreePool(FileName->Buffer);
FileName->MaximumLength = fileNameUnicodeString.Length + 2;
FileName->Buffer = ExAllocatePool(NonPagedPool,
fileNameUnicodeString.Length + 2);
}
DbgPrint(“333 Inside Outside Reparsed %wZ”, &fileNameUnicodeString);
RtlCopyUnicodeString(FileName, &fileNameUnicodeString);
DbgPrint(“444 Inside Outside Original File %wZ”, FileName);

RtlInitUnicodeString(&myUString, L"\??\D:");

IoGetDeviceObjectPointer(&myUString,FILE_ALL_ACCESS,
&FileObject,&DeviceObject);
irpStack->FileObject = FileObject;
irpStack->DeviceObject = DeviceObject;
DbgPrint(“The PAS filename is %wZ”,&FileObject->FileName);
return SpyPassThrough( DeviceObject, Irp );
// Ended
}

“Tobias” wrote in message news:xxxxx@ntfsd…
>
> From: “Lalit Singh Rana” > I wrote the following in
the
> IRP_MJ_WRITE
> >
> >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L"\DosDevices\D:\BUFFER\Ray2
> > .txt");
> > IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
> > &FileObject,&DeviceObject);
> > irpStack->FileObject = FileObject;
> > But it says invalid handle.
>
> Objectname must be the name of a device, not a file.
>
>
>
>

11

You’re redirecting the request to the device’s fileobject. So this cannot
work. You have to keep open the file you created and then redirect the write
request to this FO. The file you’re redirecting to must be a valid
representation (exact copy) of the file, as the write will effect a certain
offset. As you’re in the write path, the Zw functions are not reliable (due
to the IRQL that might be too high). They might work in many cases, but not
all the time.

----- Original Message -----
From: “Lalit S. Rana”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Saturday, June 07, 2003 3:11 PM
Subject: [ntfsd] Re: STATUS_REPARSE in IRP_MJ_WRITE

> Hi Tobias,
> As per your advice I changed the Object Name to the device name, but it
> still is not working.
> The routine creates a file D:\buffer\ray2.txt but it doesn’t write
anything
> onto it.
> Please help
> I am attaching the code.
> Lalit
>
> if(SOME COMPARSION)
> {
> FileObject = NULL;
> UNICODE_STRING myUString;
>
>
>
RtlInitUnicodeString(&fileNameUnicodeString,L"\??\D:\BUFFER\Ray2.txt");
>
> //RtlAppendUnicodeStringToString(&fileNameUnicodeString,FileName);
> InitializeObjectAttributes(&objectAttributes,
> &fileNameUnicodeString,OBJ_CASE_INSENSITIVE, NULL, NULL );
> status = ZwCreateFile ( &ntFileHandle, DELETE||FILE_GENERIC_WRITE,
> &objectAttributes, &ioStatus,
> NULL,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_VALID_FLAGS,
> FILE_WRITE_THROUGH,//FILE_OPEN_IF,
> FILE_SYNCHRONOUS_IO_NONALERT,
> NULL, 0
> );
> if( !NT_SUCCESS( status ) )
> DbgPrint(“ERROR :(”);
> else
> DbgPrint(“Success :)”);
>
> ZwClose(ntFileHandle);
>
> if((fileNameUnicodeString.Length + 2) >= FileName->MaximumLength)
> {
> DbgPrint(“Inside”);
> ExFreePool(FileName->Buffer);
> FileName->MaximumLength = fileNameUnicodeString.Length + 2;
> FileName->Buffer = ExAllocatePool(NonPagedPool,
> fileNameUnicodeString.Length + 2);
> }
> DbgPrint(“333 Inside Outside Reparsed %wZ”, &fileNameUnicodeString);
> RtlCopyUnicodeString(FileName, &fileNameUnicodeString);
> DbgPrint(“444 Inside Outside Original File %wZ”, FileName);
>
> RtlInitUnicodeString(&myUString, L"\??\D:“);
>
> IoGetDeviceObjectPointer(&myUString,FILE_ALL_ACCESS,
> &FileObject,&DeviceObject);
> irpStack->FileObject = FileObject;
> irpStack->DeviceObject = DeviceObject;
> DbgPrint(“The PAS filename is %wZ”,&FileObject->FileName);
> return SpyPassThrough( DeviceObject, Irp );
> // Ended
> }
>
>
>
> “Tobias” wrote in message news:xxxxx@ntfsd…
> >
> > From: “Lalit Singh Rana” > I wrote the following in
> the
> > IRP_MJ_WRITE
> > >
> > >
> > >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L”\DosDevices\D:\BUFFER\Ray2
> > > .txt");
> > > IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
> > > &FileObject,&DeviceObject);
> > > irpStack->FileObject = FileObject;
> > > But it says invalid handle.
> >
> > Objectname must be the name of a device, not a file.
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com

12

How can I get the File’s FileObject.
What I am doing currently is changing the file name of the device file
object.
Thanks
Lalit

“Tobias” wrote in message news:xxxxx@ntfsd…
>
> You’re redirecting the request to the device’s fileobject. So this cannot
> work. You have to keep open the file you created and then redirect the
write
> request to this FO. The file you’re redirecting to must be a valid
> representation (exact copy) of the file, as the write will effect a
certain
> offset. As you’re in the write path, the Zw functions are not reliable
(due
> to the IRQL that might be too high). They might work in many cases, but
not
> all the time.
>
> ----- Original Message -----
> From: “Lalit S. Rana”
> Newsgroups: ntfsd
> To: “File Systems Developers”
> Sent: Saturday, June 07, 2003 3:11 PM
> Subject: [ntfsd] Re: STATUS_REPARSE in IRP_MJ_WRITE
>
>
> > Hi Tobias,
> > As per your advice I changed the Object Name to the device name, but it
> > still is not working.
> > The routine creates a file D:\buffer\ray2.txt but it doesn’t write
> anything
> > onto it.
> > Please help
> > I am attaching the code.
> > Lalit
> >
> > if(SOME COMPARSION)
> > {
> > FileObject = NULL;
> > UNICODE_STRING myUString;
> >
> >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L"\??\D:\BUFFER\Ray2.txt");
> >
> > //RtlAppendUnicodeStringToString(&fileNameUnicodeString,FileName);
> > InitializeObjectAttributes(&objectAttributes,
> > &fileNameUnicodeString,OBJ_CASE_INSENSITIVE, NULL, NULL );
> > status = ZwCreateFile ( &ntFileHandle, DELETE||FILE_GENERIC_WRITE,
> > &objectAttributes, &ioStatus,
> > NULL,
> > FILE_ATTRIBUTE_NORMAL,
> > FILE_SHARE_VALID_FLAGS,
> > FILE_WRITE_THROUGH,//FILE_OPEN_IF,
> > FILE_SYNCHRONOUS_IO_NONALERT,
> > NULL, 0
> > );
> > if( !NT_SUCCESS( status ) )
> > DbgPrint(“ERROR :(”);
> > else
> > DbgPrint(“Success :)”);
> >
> > ZwClose(ntFileHandle);
> >
> > if((fileNameUnicodeString.Length + 2) >= FileName->MaximumLength)
> > {
> > DbgPrint(“Inside”);
> > ExFreePool(FileName->Buffer);
> > FileName->MaximumLength = fileNameUnicodeString.Length + 2;
> > FileName->Buffer = ExAllocatePool(NonPagedPool,
> > fileNameUnicodeString.Length + 2);
> > }
> > DbgPrint(“333 Inside Outside Reparsed %wZ”, &fileNameUnicodeString);
> > RtlCopyUnicodeString(FileName, &fileNameUnicodeString);
> > DbgPrint(“444 Inside Outside Original File %wZ”, FileName);
> >
> > RtlInitUnicodeString(&myUString, L"\??\D:“);
> >
> > IoGetDeviceObjectPointer(&myUString,FILE_ALL_ACCESS,
> > &FileObject,&DeviceObject);
> > irpStack->FileObject = FileObject;
> > irpStack->DeviceObject = DeviceObject;
> > DbgPrint(“The PAS filename is %wZ”,&FileObject->FileName);
> > return SpyPassThrough( DeviceObject, Irp );
> > // Ended
> > }
> >
> >
> >
> > “Tobias” wrote in message news:xxxxx@ntfsd…
> > >
> > > From: “Lalit Singh Rana” > I wrote the following
in
> > the
> > > IRP_MJ_WRITE
> > > >
> > > >
> > > >
> > >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L”\DosDevices\D:\BUFFER\Ray2
> > > > .txt");
> > > > IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
> > > > &FileObject,&DeviceObject);
> > > > irpStack->FileObject = FileObject;
> > > > But it says invalid handle.
> > >
> > > Objectname must be the name of a device, not a file.
> > >
> > >
> > >
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>

13

ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA,
NULL, KernelMode,
&fileObject, NULL );
if( !NT_SUCCESS( ntStatus )) {

DbgPrint(“Filter: Could not get fileobject from handle”);
ZwClose( ntFileHandle );

return FALSE;
}

Don’t forget to dereference it.

----- Original Message -----
From: “Lalit S. Rana”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Saturday, June 07, 2003 3:39 PM
Subject: [ntfsd] Re: STATUS_REPARSE in IRP_MJ_WRITE

> How can I get the File’s FileObject.
> What I am doing currently is changing the file name of the device file
> object.
> Thanks
> Lalit
>
> “Tobias” wrote in message news:xxxxx@ntfsd…
> >
> > You’re redirecting the request to the device’s fileobject. So this
cannot
> > work. You have to keep open the file you created and then redirect the
> write
> > request to this FO. The file you’re redirecting to must be a valid
> > representation (exact copy) of the file, as the write will effect a
> certain
> > offset. As you’re in the write path, the Zw functions are not reliable
> (due
> > to the IRQL that might be too high). They might work in many cases, but
> not
> > all the time.
> >
> > ----- Original Message -----
> > From: “Lalit S. Rana”
> > Newsgroups: ntfsd
> > To: “File Systems Developers”
> > Sent: Saturday, June 07, 2003 3:11 PM
> > Subject: [ntfsd] Re: STATUS_REPARSE in IRP_MJ_WRITE
> >
> >
> > > Hi Tobias,
> > > As per your advice I changed the Object Name to the device name, but
it
> > > still is not working.
> > > The routine creates a file D:\buffer\ray2.txt but it doesn’t write
> > anything
> > > onto it.
> > > Please help
> > > I am attaching the code.
> > > Lalit
> > >
> > > if(SOME COMPARSION)
> > > {
> > > FileObject = NULL;
> > > UNICODE_STRING myUString;
> > >
> > >
> > >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L"\??\D:\BUFFER\Ray2.txt");
> > >
> > > //RtlAppendUnicodeStringToString(&fileNameUnicodeString,FileName);
> > > InitializeObjectAttributes(&objectAttributes,
> > > &fileNameUnicodeString,OBJ_CASE_INSENSITIVE, NULL, NULL );
> > > status = ZwCreateFile ( &ntFileHandle, DELETE||FILE_GENERIC_WRITE,
> > > &objectAttributes, &ioStatus,
> > > NULL,
> > > FILE_ATTRIBUTE_NORMAL,
> > > FILE_SHARE_VALID_FLAGS,
> > > FILE_WRITE_THROUGH,//FILE_OPEN_IF,
> > > FILE_SYNCHRONOUS_IO_NONALERT,
> > > NULL, 0
> > > );
> > > if( !NT_SUCCESS( status ) )
> > > DbgPrint(“ERROR :(”);
> > > else
> > > DbgPrint(“Success :)”);
> > >
> > > ZwClose(ntFileHandle);
> > >
> > > if((fileNameUnicodeString.Length + 2) >= FileName->MaximumLength)
> > > {
> > > DbgPrint(“Inside”);
> > > ExFreePool(FileName->Buffer);
> > > FileName->MaximumLength = fileNameUnicodeString.Length + 2;
> > > FileName->Buffer = ExAllocatePool(NonPagedPool,
> > > fileNameUnicodeString.Length + 2);
> > > }
> > > DbgPrint(“333 Inside Outside Reparsed %wZ”, &fileNameUnicodeString);
> > > RtlCopyUnicodeString(FileName, &fileNameUnicodeString);
> > > DbgPrint(“444 Inside Outside Original File %wZ”, FileName);
> > >
> > > RtlInitUnicodeString(&myUString, L"\??\D:“);
> > >
> > > IoGetDeviceObjectPointer(&myUString,FILE_ALL_ACCESS,
> > > &FileObject,&DeviceObject);
> > > irpStack->FileObject = FileObject;
> > > irpStack->DeviceObject = DeviceObject;
> > > DbgPrint(“The PAS filename is %wZ”,&FileObject->FileName);
> > > return SpyPassThrough( DeviceObject, Irp );
> > > // Ended
> > > }
> > >
> > >
> > >
> > > “Tobias” wrote in message news:xxxxx@ntfsd…
> > > >
> > > > From: “Lalit Singh Rana” > I wrote the
following
> in
> > > the
> > > > IRP_MJ_WRITE
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
>
RtlInitUnicodeString(&fileNameUnicodeString,L”\DosDevices\D:\BUFFER\Ray2
> > > > > .txt");
> > > > > IoGetDeviceObjectPointer(&fileNameUnicodeString,FILE_ALL_ACCESS,
> > > > >
&FileObject,&DeviceObject);
> > > > > irpStack->FileObject = FileObject;
> > > > > But it says invalid handle.
> > > >
> > > > Objectname must be the name of a device, not a file.
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com