w/o using File I/O

NTFSD
1

Hello,

Didn’t do this yet but asking for its possibility:
w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building my own
IRPs and sending them to a given file system device object?

Is it straight forward step (as per the IFS kit documentation) or there are
some tricks involved?

–
Regards,
Elias

2

The tricky Irp is for IRP_MJ_CREATE. It can be done but it takes some
persistence. Check out the OSR Online article on “Rolling your own”

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of lallous
Sent: Monday, October 27, 2003 8:43 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] w/o using File I/O

Hello,

Didn’t do this yet but asking for its possibility:
w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building my
own
IRPs and sending them to a given file system device object?

Is it straight forward step (as per the IFS kit documentation) or there
are
some tricks involved?

–
Regards,
Elias

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

From previous posts on this list, ZwCreateFile is
apparently notoriously difficult.

ZwReadFile is easy (I have done this one).

I would think that ZwClose would be pretty easy as
well.

Randy

— lallous wrote:
> Hello,
>
> Didn’t do this yet but asking for its possibility:
> w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but
> instead building my own
> IRPs and sending them to a given file system device
> object?
>
> Is it straight forward step (as per the IFS kit
> documentation) or there are
> some tricks involved?
>
> –
> Regards,
> Elias
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________
Do you Yahoo!?
Exclusive Video Premiere - Britney Spears
http://launch.yahoo.com/promos/britneyspears/

4

Hello,

Before thinking of this (as my previous post), I thought of this:

Since I am writing a file system filter, then all calls to ZwCreateFile()
will pass to my filter driver…
But on the IRP_MJ_CREATE I want to do a ZwCreateFile()/Read/Close w/o
passing through my filter, so i thought of this pseudo code and I am not
sure how possible it is:

OnDriverEntry:g_pass_all = FALSE;
IRP_MJ_CREATE:

if (g_pass_all) PassDown()
else
{
AcquireAResource()
g_pass_all = TRUE;
ZwCreateFile()/Read/Close()
g_pass_all = FALSE;
ReleaseResource()
}

do you suggest such methods?

Regards,
Elias
“lallous” wrote in message news:xxxxx@ntfsd…
>
> Hello,
>
> Didn’t do this yet but asking for its possibility:
> w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building my
own
> IRPs and sending them to a given file system device object?
>
> Is it straight forward step (as per the IFS kit documentation) or there
are
> some tricks involved?
>
> –
> Regards,
> Elias
>
>
>
>

5

You may use IoCreateFileSpecifyDeviceObjectHint that is designed specially
for the purposes you have described.
This routine is available in XP and higher, but you may read how to make its
implementation under 2k here:
http://www.osronline.com/article.cfm?id=258

Regards,
Dennis.

----- Original Message -----
From: “lallous”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, October 29, 2003 12:39 PM
Subject: [ntfsd] Re: w/o using File I/O

> Hello,
>
> Before thinking of this (as my previous post), I thought of this:
>
> Since I am writing a file system filter, then all calls to ZwCreateFile()
> will pass to my filter driver…
> But on the IRP_MJ_CREATE I want to do a ZwCreateFile()/Read/Close w/o
> passing through my filter, so i thought of this pseudo code and I am not
> sure how possible it is:
>
> OnDriverEntry:g_pass_all = FALSE;
> IRP_MJ_CREATE:
>
> if (g_pass_all) PassDown()
> else
> {
> AcquireAResource()
> g_pass_all = TRUE;
> ZwCreateFile()/Read/Close()
> g_pass_all = FALSE;
> ReleaseResource()
> }
>
> do you suggest such methods?
>
> Regards,
> Elias
> “lallous” wrote in message news:xxxxx@ntfsd…
> >
> > Hello,
> >
> > Didn’t do this yet but asking for its possibility:
> > w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building my
> own
> > IRPs and sending them to a given file system device object?
> >
> > Is it straight forward step (as per the IFS kit documentation) or there
> are
> > some tricks involved?
> >
> > –
> > Regards,
> > Elias
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@acronis.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

6

Thanks!

Elias
“Dennis S. Dyatlov” wrote in message
news:xxxxx@ntfsd…
>
> You may use IoCreateFileSpecifyDeviceObjectHint that is designed specially
> for the purposes you have described.
> This routine is available in XP and higher, but you may read how to make
its
> implementation under 2k here:
> http://www.osronline.com/article.cfm?id=258
>
> Regards,
> Dennis.
>
> ----- Original Message -----
> From: “lallous”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Wednesday, October 29, 2003 12:39 PM
> Subject: [ntfsd] Re: w/o using File I/O
>
>
> > Hello,
> >
> > Before thinking of this (as my previous post), I thought of this:
> >
> > Since I am writing a file system filter, then all calls to
ZwCreateFile()
> > will pass to my filter driver…
> > But on the IRP_MJ_CREATE I want to do a ZwCreateFile()/Read/Close w/o
> > passing through my filter, so i thought of this pseudo code and I am not
> > sure how possible it is:
> >
> > OnDriverEntry:g_pass_all = FALSE;
> > IRP_MJ_CREATE:
> >
> > if (g_pass_all) PassDown()
> > else
> > {
> > AcquireAResource()
> > g_pass_all = TRUE;
> > ZwCreateFile()/Read/Close()
> > g_pass_all = FALSE;
> > ReleaseResource()
> > }
> >
> > do you suggest such methods?
> >
> > Regards,
> > Elias
> > “lallous” wrote in message news:xxxxx@ntfsd…
> > >
> > > Hello,
> > >
> > > Didn’t do this yet but asking for its possibility:
> > > w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building
my
> > own
> > > IRPs and sending them to a given file system device object?
> > >
> > > Is it straight forward step (as per the IFS kit documentation) or
there
> > are
> > > some tricks involved?
> > >
> > > –
> > > Regards,
> > > Elias
> > >
> > >
> > >
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@acronis.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>

7

the problem with create is that it uses some undocumented APIs, so it “may”
break one day. the safest way is to use shadowdevices for creates, and roll
own irps for read and close.

Ampsi

----- Original Message -----
From: “Peter Scott”
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, October 28, 2003 00:05
Subject: [ntfsd] RE: w/o using File I/O

The tricky Irp is for IRP_MJ_CREATE. It can be done but it takes some
persistence. Check out the OSR Online article on “Rolling your own”

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of lallous
Sent: Monday, October 27, 2003 8:43 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] w/o using File I/O

Hello,

Didn’t do this yet but asking for its possibility:
w/o using ZwCreateFile()/ZwReadFile()/ZwClose() but instead building my
own
IRPs and sending them to a given file system device object?

Is it straight forward step (as per the IFS kit documentation) or there
are
some tricks involved?

–
Regards,
Elias

—
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
You are currently subscribed to ntfsd as: xxxxx@hotmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com