I found a very strange problem.
my filter will work well in many WinXP,but in some WinXP(maybe add some
hotfix),my filter will meet a strange recursive IRP_MJ_CREATE.
I will describe it by the following example:
1.explorer.exe (PID 5ec,TID 750) open D:\1.txt
in my filter,I meet a IRP_MJ_CREATE for D:\1.txt
2.In this IRP_MJ_CREATE,I will call IoCreateFileSpecifyDeviceObjectHint for D:\1.txt ,
I issue it in the same thread context(PID 5ec,TID 750).
3.I will meet many recursive IRP_MJ_CREATE!
these IRP_MJ_CREATE is for:
C:\WINDOWS\system32\Msctf.dll
…
This problem is very strange.I’m not newbie in FSD filter.
please refer my code and windbg’s out.
In my filter IRP_MJ_CREATE handler:
my test code is following:
{
…g_timeout is 30 seconds…
NTSTATUS statusSyn;
statusSyn=KeWaitForSingleObject(g_pSyn_Test,Executive,KernelMode,FALSE,&g_timeout);
if (statusSyn==STATUS_TIMEOUT)
{
KdPrint((“\r\n@@@@@@timeout:%x,%x,%ws”,nThisPID,nThisTID,szFileName));
KdPrint((“\r\n!!!timeout”));
}
KdPrint((“\r\n—before Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
HandleSmart(pDevObj,szFileName);//my call FSD
nRet=KfCallFileSystem(pDevObj,Irp);
KdPrint((“\r\n!!!after Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
IoCompleteRequest(Irp,IO_NO_INCREMENT);
KdPrint((“\r\n^^^complete Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
KeReleaseSemaphore(g_pSyn_Test,0,1,FALSE);
return nRet;
}
the function HandleSmart is:
void HandleSmart(PDEVICE_OBJECT pDevObj,PWCHAR fullpathname)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
UNICODE_STRING FileName;
OBJECT_ATTRIBUTES ObjectAttributes;
IO_STATUS_BLOCK IoStatus;
NTSTATUS Status = STATUS_SUCCESS;
HANDLE hFile;
PWCHAR fullpathnameIO=NULL;
fullpathnameIO=(PWCHAR)ExAllocatePool(NonPagedPool,MAX_PATH_LEN*sizeof(WCHAR));
memset(fullpathnameIO,0,MAX_PATH_LEN*sizeof(WCHAR));
wcscpy(fullpathnameIO,L"\??\“);
wcscat(fullpathnameIO,fullpathname);
KdPrint((”\r\nMy FileName:%ws",fullpathnameIO));
RtlInitUnicodeString(&FileName, fullpathnameIO);
InitializeObjectAttributes(&ObjectAttributes, // ptr to structure
&FileName, // ptr to file spec
OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE, // attributes
NULL, // root directory handle
NULL ); // ptr to security descriptor
KdPrint((“\r\nOpeExistSmart Create 1 before:%ws”,fullpathname));
Status= IoCreateFileSpecifyDeviceObjectHint(
&hFile,
(SYNCHRONIZE | FILE_READ_DATA|FILE_READ_ATTRIBUTES),
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0,
CreateFileTypeNone,
NULL,
IO_IGNORE_SHARE_ACCESS_CHECK,
pDevExt->pFileSystemDeviceObject
);
KdPrint((“\r\nOpeExistSmart Create 2 after:%ws”,fullpathname));
if(!NT_SUCCESS(Status))
{
ExFreePool(fullpathnameIO);
return ;
}
ExFreePool(fullpathnameIO);
KdPrint((“\r\nOpeExistSmart Create close before:%ws”,fullpathname));
ZwClose(hFile);
KdPrint((“\r\nOpeExistSmart Create close after:%ws”,fullpathname));
}
When I single-click the D:\1.txt in Explorer.exe,the windbg’s output is:
—before Open :5ec,750,D:\1.txt
My FileName:??\D:\1.txt
OpeExistSmart Create 1 before:D:\1.txt
OpeExistSmart Create 2 after:D:\1.txt
OpeExistSmart Create close before:D:\1.txt
OpeExistSmart Create close after:D:\1.txt
!!!after Open :5ec,750,D:\1.txt
^^^complete Open :5ec,750,D:\1.txt
—before Open :5ec,750,D:\1.txt
My FileName:??\D:\1.txt
OpeExistSmart Create 1 before:D:\1.txt
OK,deadlock,after 30 seconds,the windbg’s output is:
@@@@@@timeout:264,f8,C:\WINDOWS\system32\Msctf.dll
the process 5ec is Explorer.exe
the process 264 is WinLogon.exe
