STATUS_REPARSE problems.

NTFSD
1

Hello,

I am trying to create a minifilter that redirects some create operations. Most of the implementation is done but I have some questions:

Example:

  1. Receive Create operation on \Device\HardDiskVolume1\Test\a.txt
  2. Redirect to \Device\HardDiskVolume1\AnotherFolder\a.txt by
    changing the FILE_OBJECT, set STATUS_REPARSE and FLT_PREOP_COMPLETE.

After these steps I receive the create operation on the file that I redirected \Device\HardDiskVolume1\AnotherFolder\a.txt.

My Question:
How can I know that this request was previously redirected with STATUS_REPARSE ?
There is some flag that I can check?

Currently I am checking the path. For example if it is \Device\HardDiskVolume1\AnotherFolder\a.txt that means that previously was redirected but is not such a good idea.

Thanks in advance!

2

> How can I know that this request was previously redirected with

STATUS_REPARSE ?

I believe you can set an ECP in >= Vista. Prior to that you need to get
clever (and very lucky) with lists of threads and it doesn’t work all that
satisfactorily…

I suggest you read this

http://fsfilters.blogspot.com/2012/02/problems-with-statusreparse-part-i.html

3

I would also add this link: http://fsfilters.blogspot.com/2011/01/about-irpmjcreate-and-minifilter-design.html since it discusses specifically usage of ECP for tracking reparsed creates.

However, as Rod pointed out, if ECPs are not available then you might be better off with an architecture that doesn’t require that you track STATUS_REPARSE.

Thanks,
Alex.