Strange about filemon?

NTFSD
1

hello everyone,
i modified the filemon to write protect my file,in the dispatch
runtine,
case IRP_MJ_WRITE:
GetFullName(fullname);
if (strcmp(fullname,“d:\1.txt”)==0)
{
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
IoCompleteRequest( Irp, IO_NO_INCREMENT );

}
break;
i do this to protect my file d:\1.txt,but in windows it works,but in
the dos,i can open,edit and write the file,what is the problem?
is there other way that i can not controlled?
best regards
ding hao

ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com

2

Maybe DOS sends “D:\1.TXT” instead of “d:\1.txt”.

L.

----- Original Message -----
From: “shark marian”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, December 16, 2004 12:57 PM
Subject: [ntfsd] Strange about filemon?

> hello everyone,
> i modified the filemon to write protect my file,in the dispatch
> runtine,
> case IRP_MJ_WRITE:
> GetFullName(fullname);
> if (strcmp(fullname,“d:\1.txt”)==0)
> {
> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
> Irp->IoStatus.Information = 0; IoCompleteRequest( Irp,
> IO_NO_INCREMENT );
> } break;
> i do this to protect my file d:\1.txt,but in windows it works,but in
> the dos,i can open,edit and write the file,what is the problem?
> is there other way that i can not controlled?
> best regards
> ding hao
>
> _________________________________________________________________
> ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@volny.cz
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

3

Well you have a number of problems, first and foremost is you are using
filemon which needs a license. I suspect if you pay Mark Russinovich of
Sysinterals what he charges for use of the Filemon source, he will happily
help you for a small delta more.

If not you might want to buy the IFS kit, and start with FileSpy. You might
also read the past postings on this newsgroup for data on how to do what you
are asking, since it has been well discussed (hint your technique has lots
of problems).

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“shark marian” wrote in message
news:xxxxx@ntfsd…
> hello everyone,
> i modified the filemon to write protect my file,in the dispatch
> runtine,
> case IRP_MJ_WRITE:
> GetFullName(fullname);
> if (strcmp(fullname,“d:\1.txt”)==0)
> {
> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
> Irp->IoStatus.Information = 0;
> IoCompleteRequest( Irp, IO_NO_INCREMENT );
>
> }
> break;
> i do this to protect my file d:\1.txt,but in windows it works,but in
> the dos,i can open,edit and write the file,what is the problem?
> is there other way that i can not controlled?
> best regards
> ding hao
>
> _________________________________________________________________
> ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com
>
>

4

Wrong.
You must fail opens with write intent, and not writes.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “shark marian”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, December 16, 2004 2:57 PM
Subject: [ntfsd] Strange about filemon?

> hello everyone,
> i modified the filemon to write protect my file,in the dispatch
> runtine,
> case IRP_MJ_WRITE:
> GetFullName(fullname);
> if (strcmp(fullname,“d:\1.txt”)==0)
> {
> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
> Irp->IoStatus.Information = 0;
> IoCompleteRequest( Irp, IO_NO_INCREMENT );
>
> }
> break;
> i do this to protect my file d:\1.txt,but in windows it works,but in
> the dos,i can open,edit and write the file,what is the problem?
> is there other way that i can not controlled?
> best regards
> ding hao
>
> _________________________________________________________________
> ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>