Joy of joy, installed vista. Have a file system filter that performs transparent encryption and unscrambles file/folder names on removable media to their correct names once the correct password is entered and our driver loaded. Works fine in a command prompt, and the transparent decryption works fine if you can tell the Vista app where to find the file, but Explorer simply will not update it’s file/folder listing to reflect the correct (unscrambled by my driver) file names. F5 or right-click “refresh” does nothing - the file and folder names as they existed before my driver was loaded persist.
Joy of joy, installed vista. Have a file system filter that performs
transparent encryption and unscrambles file/folder names on removable
media to their correct names once the correct password is entered and
our driver loaded. Works fine in a command prompt, and the transparent
decryption works fine if you can tell the Vista app where to find the
file, but Explorer simply will not update it’s file/folder listing to
reflect the correct (unscrambled by my driver) file names. F5 or
right-click “refresh” does nothing - the file and folder names as they
existed before my driver was loaded persist.
This is entirely speculation, but something to at least consider…
Possibly the explorer code in vista avoids manual refreshes and relies
entirely on change notifications (a possible CIFS browsing optimization as
a possible motivation - again total speculation I know nothing here…)
and turns the f5 into an idiot button. I think in previous OSs I’ve seen
explorer do refreshes periodically even without a DCN callback, so your
stuff might have ‘just worked’ and certainly f5 would have done the trick.
This should be fairly (dis)provable however:
You should be able to watch in filemon what happens when you press f5.
Try copying a file to the disk and see if explorer magically wakes up with
a DCN completion.
Issuing DCNs events is pretty much the domain of actual file systems, but
you might want to consider what you can do to force a file system DCN
change or start handling DCN in your filter (the later being a dubious
thing IMHO).
Well, it’s not a refresh problem. Copied a file over while the media was unlocked (our driver loaded and unscrambling filenames) and the name of the file in Explorer appeared as it would on disk - scrambled. So it appears Explorer is somehow bypassing my filter for directory info tho filemon just shows IRP_MJ_DIRECTORY_CONTROL QueryDirectory which I know I’m trapping. Time to figure out how to remotely kernel debug Vista I guess…
Make sure that you are not leaking scrambled file names via
IRP_MJ_DIRECTORY_CONTROL/IRP_MN_NOTIFY_CHANGE_DIRECTORY. Explorer uses this
mechanism to update directory contents.
Alexei.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of xxxxx@yahoo.com
Sent: Thursday, February 01, 2007 10:33 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Vista filename filter problem
Well, it’s not a refresh problem. Copied a file over while the media was
unlocked (our driver loaded and unscrambling filenames) and the name of the
file in Explorer appeared as it would on disk - scrambled. So it appears
Explorer is somehow bypassing my filter for directory info tho filemon just
shows IRP_MJ_DIRECTORY_CONTROL QueryDirectory which I know I’m trapping.
Time to figure out how to remotely kernel debug Vista I guess…
Alexi, I don’t filter NOTIFY_CHANGE_DIRECTORY because (if I remember correctly) an older version of Norton AV would sometimes BSOD on this when I did, and secondly I thought, (incorrectly?), it was just a notification mechanism to let the caller know things had changed but no directory info was actually passed - the caller would request the info it wanted after receiving notice things had changed.
Explorer wouldn’t use the notify mechanism while processing an F5 refresh request would it? The filenames remain scrambled then as well…
As far as I know NOTIFY_CHANGE_DIRECTORY returns file names along with
notifications if there is not too many changes to report otherwise it fall
back on just notifing that something happened.
I would not expect explorer to rely on NOTIFY_CHANGE_DIRECTORY while
processing F5 refresh though.
Alexei.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of xxxxx@yahoo.com
Sent: Thursday, February 01, 2007 12:41 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Vista filename filter problem
Alexi, I don’t filter NOTIFY_CHANGE_DIRECTORY because (if I remember
correctly) an older version of Norton AV would sometimes BSOD on this when I
did, and secondly I thought, (incorrectly?), it was just a notification
mechanism to let the caller know things had changed but no directory info was
actually passed - the caller would request the info it wanted after receiving
notice things had changed.
Explorer wouldn’t use the notify mechanism while processing an F5 refresh
request would it? The filenames remain scrambled then as well…
Yes, but are you trapping the right FileInformationClass?
The newest FileMon is giving little useful data, I suggest (unless you’re on Vista 64) to take the old one and check what’s up.
Well, it’s not a refresh problem. Copied a file over while the media was unlocked (our driver loaded and unscrambling filenames) and the name of the file in Explorer appeared as it would on disk - scrambled. So it appears Explorer is somehow bypassing my filter for directory info tho filemon just shows IRP_MJ_DIRECTORY_CONTROL QueryDirectory which I know I’m trapping. Time to figure out how to remotely kernel debug Vista I guess…
–
King regards, Dejan http://www.alfasp.com
File system audit, security and encryption kits.