Streamfile object use in filter driver

NTFSD
1

Hi all,
I noticed that in the solution to the problems recently
discovered with IoCancelFileOpen, the workaround uses a streamfile
object in the create IRP to do read and writes to the file before it
permits a create. After the create succeeds, the filter driver is free
to use this streamfile object however it sees fit. Is there an easy way
to create streamfile objects for use in a filter driver (so I can roll
read and write IRPs) w/o doing this file object substitution on a seen
create? I was thinking about manually constructing CREATE IRPs, but the
OSR IFS FAQ states that building create IRPs is a “fragile” solution.
Any comments?

Thanks,
Matt

2

if you want to open files and access them w/o re-entrancy issues, use the
shadow device method suggested by OSR.

Ampsi

----- Original Message -----
From: “Matthew White”
To: “File Systems Developers”
Sent: Friday, May 30, 2003 09:40
Subject: [ntfsd] Streamfile object use in filter driver

Hi all,
I noticed that in the solution to the problems recently
discovered with IoCancelFileOpen, the workaround uses a streamfile
object in the create IRP to do read and writes to the file before it
permits a create. After the create succeeds, the filter driver is free
to use this streamfile object however it sees fit. Is there an easy way
to create streamfile objects for use in a filter driver (so I can roll
read and write IRPs) w/o doing this file object substitution on a seen
create? I was thinking about manually constructing CREATE IRPs, but the
OSR IFS FAQ states that building create IRPs is a “fragile” solution.
Any comments?

Thanks,
Matt

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> permits a create. After the create succeeds, the filter driver is free

to use this streamfile object however it sees fit. Is there an easy way
to create streamfile objects for use in a filter driver (so I can roll
read and write IRPs) w/o doing this file object substitution on a seen
create?

In orders to use file object in read/write IRP some fields in it must be
properly initialized and must point to some structures created by file
system. The only way file system filter can achieve this is sending create
IRP. File system drivers do create stream file objects to perform read/write
but they have enough information to properly initialize file object.

I was thinking about manually constructing CREATE IRPs, but the
OSR IFS FAQ states that building create IRPs is a “fragile” solution.

Yes, it is a “fragile” solution. Why you don’t want to use ZwCreateFile or
IoCreateFile instead?
On XP you can use IoCreateFileSpecifyDeviceObjectHint to avoid reentrancy,
on Windows 2000 an earlier you need to handle reentrancy yourself. But it is
definitely much easier than creating your own Create IRP.

Alexei.