Trying to make the shadow device technique work EXACTLY like IoCreateFileSpecifyDeviceObjectHint()

NTFSD
1

Hi All,

I have a need to open files from inside my filter and I don’t want to
create recursion issues or eat up a lot of stack. Since my filter also
needs to work on NT4 (:-)) I have to implement the shadow device
technique as illustrated by OSR in one of the articles. My problem is
that I want all the IRP’s to be redirected to the shadow device, not
just create. I am thinking of a few things and would like to know your
opinion on these:

  1. when dispatching the create on the shadow device to the device
    below me, I set the fobj->DeviceObject = StorageDeviceObject,
    increment the reference count on the StorageDeviceObject and do a
    IoCallDriver on the next FileSystem device object.

Question: Do I really need to the fobj->DeviceObject to the
StorageDeviceObject? or is just increasing the reference count enough?

  1. When the CREATE is completed, the FSD also populates the VPB. Now
    IoGetRelatedDeviceObject() starts working differently and all requests
    go to the top of the stack.

2a. If I want all further requests to go to the shadow device, is it
sufficient to set the VPB to 0 and decrement the reference count on
the VPB (in create completion)? so that the requests go to
fobj->DeviceObject which happens to be my ShadowDeviceObject?

2b.Is the FileSystem fine with receiving non-CREATE IRP’s with fobjs
which don’t have Vpb set? If this is the case, will I need to populate
my own VPB such that the vpb->DeviceObject points to my ShadowDevice?

Am I missing something? Is there something I should be careful about?
Any other suggestions on achieving this?

Thanks

2

>

Question: Do I really need to the fobj->DeviceObject to the
StorageDeviceObject? or is just increasing the reference count enough?

Hmm, looks like I need to do this to keep NTFS happy.

I still have the other questions i.e. what all needs to be done in
create completion to ensure that all further requests also go to the
shadow device (which i will then forward to the lower device).

Thanks