Using MRX_FCB

NTFSD
1

Hello~

I am making minifilter which can be operated upon NFS(Network FileSystem).

And I read article ‘Caching in Network File System’ at this Site.

So I want to reference FcbState flag in MRX_FCB structure.

I set MRX_FCB address by catching FltObjects->FileObject->FsContext in pre&post callback operation of IRP_MJ_READ.

But the value of FcbState is abnormal value compare to MSDN reference.

Is there any problem in my code?

or any other proper way to using FcbState?

The code is below…

#include <rx.h>
…
PMRX_FCB mrxfcb;
mrxfcb = (PMRX_FCB)FltObjects->FileObject->FsContext;
DbgPrint(“mrxfcb->FcbState = 0x%08x”, mrxfcb->FcbState );</rx.h>

2

MRX_FCB is relevant only for RDBSS based drivers. And only for the Windows version up to XP (I think on Vista smb, webdav and othe MS redirectors are already built on top of RDBSS 2). So, you can’t make any assumptions that FO->FsContext will be pointing to MRX_FCB. The only safe assumption you can make that it’s pointing to common (or advanced) FCB header as defined in ntifs.h

3

Thank you for your reply.

I re-read the article ‘caching in network file system’, and other threads in this board.
You’re right, I cannot assume that Fscontext will point MRX_FCB.

But, it is certain that there are IRPs through network file system, in these case Fscontext will point MRX_FCB.
And I came to know that MRX_FCB is different from among OS’s versions.

So I have additional two questions.

  1. Is there any way to determine what Fscontext is pointing, common header structure or MRX_FCB?

  2. Do I have to have all MRX_FCB structure of all windows version? If then, can I get all versions? I have only WDK6000 header.