Hello all,
Can anyone tell me what this flag means in the file object->flags?
Thanks
Greg
The file object represents a device and not a file.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
Sent: Friday, April 30, 2004 10:06 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
Hello all,
Can anyone tell me what this flag means in the file object->flags?
Thanks
Greg
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
FYI - I found an explanation, from Microsoft:
Relative Open Requests for Direct Device Open Handles
The I/O Manager performs a direct device open in response to create or open
requests that meet all of the following criteria:
· The volume name has no trailing characters. For example, G: is
valid, but G:\ and G:\a\b are not.
· The create request is not relative to another file handle.
· The requested access includes one or more of the following, and no
other access types: SYNCHRONIZE, FILE_READ_ATTRIBUTES, READ_CONTROL,
ACCESS_SYSTEM_SECURITY, WRITE_OWNER, WRITE_DAC
For a normal create or open request on a storage volume, the I/O Manager
typically attempts to mount a file system, if none is already mounted.
However, when performing a direct device open, the I/O Manager does not
mount or send requests through a file system. Instead, it sends the
IRP_MJ_CREATE request directly to the storage stack, bypassing any file
system that has been mounted for the volume. Requests for further operations
(such as read, write, or DeviceIoControl) on the file handle are sent to the
topmost device object in the storage stack for the volume.
The I/O Manager performs a direct device open only when the caller requests
limited access to the device, such as the access required to read device
attributes. This type of open operation occurs rarely, but is useful when an
application wants to query certain attributes of a storage volume without
forcing a file system to be mounted.
If an application later sends an open request that is relative to a handle
on which the I/O Manager performed a direct device open, the file system
stack receives a file object in which the RelatedFileObject field points to
an object that the file system has not previously seen. To determine whether
the I/O Manager performed a direct device open on a file object, a file
system driver can test the FO_DIRECT_DEVICE_OPEN flag in the Flags field of
the file object.
On Microsoft® Windows NT® 4.0 and earlier versions of Windows NT, relative
open requests for direct device open handles failed. This problem has been
corrected in Microsoft Windows® 2000 and later releases.
— end of microsoft text —
“Greg Pearce” wrote in message news:xxxxx@ntfsd…
> Hello all,
>
> Can anyone tell me what this flag means in the file object->flags?
>
> Thanks
>
> Greg
>
>
>
Thanks Jamey - that helps. I also found (and posted) Microsoft’s
explanation in a subsequent post.
Greg
“Jamey Kirby” wrote in message news:xxxxx@ntfsd…
> The file object represents a device and not a file.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
> Sent: Friday, April 30, 2004 10:06 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
>
> Hello all,
>
> Can anyone tell me what this flag means in the file object->flags?
>
> Thanks
>
> Greg
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
Thanks Jamey, (and everyone else)… the reason I asked this question is
that I’m getting the following ASSERT and cannot figure out how to get
around it - anyone else have this problem? It happens when I right click on
a directory to get the “Sharing” menu, to establish a share for the root
directory on my FSD:
*** Assertion Failed: !(FileObject->Flags & FO_DIRECT_DEVICE_OPEN )
*** Source file: D:\nt\private\ntos\io\iosubs.c, Line 7286
I found a hit in the archives from 2 years ago, but no one responded to the
guy that asked the same question.
Thanks
Greg
“Jamey Kirby” wrote in message news:xxxxx@ntfsd…
> The file object represents a device and not a file.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
> Sent: Friday, April 30, 2004 10:06 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
>
> Hello all,
>
> Can anyone tell me what this flag means in the file object->flags?
>
> Thanks
>
> Greg
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
Greg,
Can you give us a stack trace for the system when you get this assert?
That will give a better idea of what is happening.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources Inc
http://www.osr.com
http://www.osronline.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
Sent: Tuesday, May 04, 2004 10:33 AM
To: ntfsd redirect
Subject: Re:[ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
Thanks Jamey, (and everyone else)… the reason I asked this question is
that I’m getting the following ASSERT and cannot figure out how to get
around it - anyone else have this problem? It happens when I right
click on
a directory to get the “Sharing” menu, to establish a share for the root
directory on my FSD:
*** Assertion Failed: !(FileObject->Flags & FO_DIRECT_DEVICE_OPEN )
*** Source file: D:\nt\private\ntos\io\iosubs.c, Line 7286
I found a hit in the archives from 2 years ago, but no one responded to
the
guy that asked the same question.
Thanks
Greg
“Jamey Kirby” wrote in message
news:xxxxx@ntfsd…
> The file object represents a device and not a file.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
> Sent: Friday, April 30, 2004 10:06 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
>
> Hello all,
>
> Can anyone tell me what this flag means in the file object->flags?
>
> Thanks
>
> Greg
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yes! Here it is…
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
be653160 8054fb24 81645628 8054ee05 816b9420
nt!IoGetRelatedDeviceObject+0x30
be6532e4 804a3178 816b9438 00000000 be65339c nt!NtWriteFile+0x1fb8a
be65335c 8057a8e5 00000000 be653458 00000040 nt!ObFindHandleForObject+0xa6e
be65346c 8051ebcd 00000000 00000000 00000001 nt!ObOpenObjectByName+0x119
be653540 8052c311 0a78ee1c 00100080 0a78edec nt!IoCreateFile+0x425
be653588 804bfb2a 0a78ee1c 00100080 0a78edec nt!NtOpenFile+0x57
be6535b4 77f78c8f badb0d00 0a78ebb8 be65360c nt!KiReleaseSpinLock+0xcca
0a78ee20 77e8692c 000e54b8 0a78ee78 00000104 0x77f78c8f
0a78ee4c 78785e47 000e54b8 0a78ee78 00000104
KERNEL32!GetVolumeNameForVolumeMountPointW+0x8d
0a78ee60 7872845e 000e54b8 0a78ee78 00000104 SHELL32!Ordinal715+0x2477a
0a78f080 78728437 00000000 00000000 0a78f0b0 SHELL32!Ordinal690+0x1ed5f
0a78f090 787283df 00000000 0a78f238 00000000 SHELL32!Ordinal690+0x1ed38
0a78f0b0 78737a49 00070000 00000000 00000000 SHELL32!Ordinal690+0x1ece0
0a78f0f0 786e7b63 00000001 00000000 000db100 SHELL32!Ordinal690+0x2e34a
0a78f1bc 7865ef1d 000b73d0 00050062 000b5f08 SHELL32!Ordinal230+0xefc
0a78f1dc 7865f049 000cfcc8 000b73d0 00050062 SHELL32!Ordinal701+0x14e
0a78f254 78683c53 f0400154 00060101 00000000 SHELL32!Ordinal701+0x27a
0a78f504 7866c18a 00060101 77dd2358 10000000 SHELL32!Ordinal83+0x1051
0a78f714 77e096f0 000100b8 0000007b 000100ba SHELL32!Ordinal67+0x7e2
0a78f734 77ddebad 7866bbd5 000100b8 0000007b USER32!SetWindowPlacement+0x4e
Thanks for looking at it…
Greg
“Tony Mason” wrote in message news:xxxxx@ntfsd…
Greg,
Can you give us a stack trace for the system when you get this assert?
That will give a better idea of what is happening.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources Inc
http://www.osr.com
http://www.osronline.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
Sent: Tuesday, May 04, 2004 10:33 AM
To: ntfsd redirect
Subject: Re:[ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
Thanks Jamey, (and everyone else)… the reason I asked this question is
that I’m getting the following ASSERT and cannot figure out how to get
around it - anyone else have this problem? It happens when I right
click on
a directory to get the “Sharing” menu, to establish a share for the root
directory on my FSD:
Assertion Failed: !(FileObject->Flags & FO_DIRECT_DEVICE_OPEN )
Source file: D:\nt\private\ntos\io\iosubs.c, Line 7286
I found a hit in the archives from 2 years ago, but no one responded to
the
guy that asked the same question.
Thanks
Greg
“Jamey Kirby” wrote in message
news:xxxxx@ntfsd…
> The file object represents a device and not a file.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
> Sent: Friday, April 30, 2004 10:06 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
>
> Hello all,
>
> Can anyone tell me what this flag means in the file object->flags?
>
> Thanks
>
> Greg
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Greg,
Thanks. Nothing quite like running a remote debugger session over
SMTP…
Can you confirm your symbol set up here? I ask, because I don’t see any
calls from ObFindHandleForObject:
lkd> u nt!ObFindHandleForObject
nt!ObFindHandleForObject:
805a3ed2 55 push ebp
805a3ed3 8bec mov ebp,esp
805a3ed5 83ec0c sub esp,0xc
805a3ed8 53 push ebx
805a3ed9 ff7508 push dword ptr [ebp+0x8]
805a3edc 33db xor ebx,ebx
805a3ede e8bfa6ffff call nt!ObReferenceProcessHandleTable
(8059e5a2)
805a3ee3 3bc3 cmp eax,ebx
nt!ObFindHandleForObject+0x13:
805a3ee5 743e jz nt!ObFindHandleForObject+0x53
(805a3f25)
805a3ee7 8b4d0c mov ecx,[ebp+0xc]
805a3eea 3bcb cmp ecx,ebx
805a3eec 7408 jz nt!ObFindHandleForObject+0x24
(805a3ef6)
805a3eee 83c1e8 add ecx,0xffffffe8
805a3ef1 894df4 mov [ebp-0xc],ecx
805a3ef4 eb03 jmp nt!ObFindHandleForObject+0x27
(805a3ef9)
805a3ef6 895df4 mov [ebp-0xc],ebx
nt!ObFindHandleForObject+0x27:
805a3ef9 8b4d10 mov ecx,[ebp+0x10]
805a3efc ff7518 push dword ptr [ebp+0x18]
805a3eff 894df8 mov [ebp-0x8],ecx
805a3f02 8b4d14 mov ecx,[ebp+0x14]
805a3f05 894dfc mov [ebp-0x4],ecx
805a3f08 8d4df4 lea ecx,[ebp-0xc]
805a3f0b 51 push ecx
805a3f0c 68563e5a80 push 0x805a3e56
nt!ObFindHandleForObject+0x3f:
805a3f11 50 push eax
805a3f12 e811590400 call nt!ExEnumHandleTable (805e9828)
805a3f17 84c0 test al,al
805a3f19 7402 jz nt!ObFindHandleForObject+0x4b
(805a3f1d)
805a3f1b b301 mov bl,0x1
805a3f1d ff7508 push dword ptr [ebp+0x8]
805a3f20 e8b1a6ffff call nt!ObDereferenceProcessHandleTable
(8059e5d6)
805a3f25 8ac3 mov al,bl
nt!ObFindHandleForObject+0x55:
805a3f27 5b pop ebx
805a3f28 c9 leave
805a3f29 c21400 ret 0x14
I do believe the last call (IoGetRelatedDeviceObject) since I can find
that assert (in a checked OS build). So at least you can also provide
information on the file object:
dt nt!_FILE_OBJECT
From that it might be possible to unravel a bit more of what is
happening here.
The basic point: you are performing an operation
(IoGetRelatedDeviceObject) on a volume open and the I/O Manager is
confused, since you shouldn’t be doing that.
Regards,
Tony
Tony,
I unassembled ObFindHandleForObject and got this:
kd> u nt!ObFindHandleForObject
nt!ObFindHandleForObject:
804a270a 55 push ebp
804a270b 8bec mov ebp,esp
804a270d 83ec10 sub esp,0x10
804a2710 53 push ebx
804a2711 33db xor ebx,ebx
804a2713 56 push esi
804a2714 885dff mov [ebp-0x1],bl
804a2717 64a124010000 mov eax,fs:[00000124]
The Symbol path is this:
srv*c:\symbolstore*http://msdl.microsoft.com/download/symbols;C:\current\dri
ver7\objchk_w2k_x86\i386
I thought I was getting the right symbols using this method? but apparently
not.
I dumped out a few control blocks: (and it clearly is my device object
involved, but I still don’t understand the problem…)
kd> dt _FILE_OBJECT 814e4468
+0x000 Type : 5
+0x002 Size : 112
+0x004 DeviceObject : 0x816b9438
+0x008 Vpb : 0x816b93a8
+0x00c FsContext : (null)
+0x010 FsContext2 : (null)
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : (null)
+0x01c FinalStatus : 0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ‘’
+0x025 DeletePending : 0 ‘’
+0x026 ReadAccess : 0 ‘’
+0x027 WriteAccess : 0 ‘’
+0x028 DeleteAccess : 0 ‘’
+0x029 SharedRead : 0 ‘’
+0x02a SharedWrite : 0 ‘’
+0x02b SharedDelete : 0 ‘’
+0x02c Flags : 0x806
+0x030 FileName : _UNICODE_STRING “”
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)
kd> dt _DEVICE_OBJECT 816b9438
+0x000 Type : 3
+0x002 Size : 0xb8
+0x004 ReferenceCount : 1
+0x008 DriverObject : 0x816b9a98
+0x00c NextDevice : 0x816b9558
+0x010 AttachedDevice : (null)
+0x014 CurrentIrp : (null)
+0x018 Timer : (null)
+0x01c Flags : 0x40
+0x020 Characteristics : 0x100
+0x024 Vpb : 0x816b93a8
+0x028 DeviceExtension : (null)
+0x02c DeviceType : 0x24
+0x030 StackSize : 1 ‘’
+0x034 Queue : __unnamed
+0x05c AlignmentRequirement : 0
+0x060 DeviceQueue : _KDEVICE_QUEUE
+0x074 Dpc : _KDPC
+0x094 ActiveThreadCount : 0
+0x098 SecurityDescriptor : 0xe1416568
+0x09c DeviceLock : _KEVENT
+0x0ac SectorSize : 0x200
+0x0ae Spare1 : 0
+0x0b0 DeviceObjectExtension : 0x816b94f0
+0x0b4 Reserved : (null)
kd> dt _VPB 816b93a8
+0x000 Type : 10
+0x002 Size : 88
+0x004 Flags : 1
+0x006 VolumeLabelLength : 0
+0x008 DeviceObject : 0x816b9558
+0x00c RealDevice : 0x816b9438
+0x010 SerialNumber : 0x12345678
+0x014 ReferenceCount : 5
+0x018 VolumeLabel : [32] 0
kd> dt _DRIVER_OBJECT 816b9a98
+0x000 Type : 4
+0x002 Size : 168
+0x004 DeviceObject : 0x816b9438
+0x008 Flags : 0x12
+0x00c DriverStart : 0xbf6f8000
+0x010 DriverSize : 0x13e80
+0x014 DriverSection : 0x816b9bc8
+0x018 DriverExtension : 0x816b9b40
+0x01c DriverName : _UNICODE_STRING “\FileSystem\FTKFSD”
+0x024 HardwareDatabase : 0x80630198
“\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM”
+0x028 FastIoDispatch : 0xbf6fafe0
+0x02c DriverInit : 0xbf709830 ftkfsd!DriverEntry+0
+0x030 DriverStartIo : (null)
+0x034 DriverUnload : 0xbf6fedd0 ftkfsd!DriverExit+0
+0x038 MajorFunction : [28] 0xbf6fe810 ftkfsd!FsdDispatch+0
Thanks a lot for looking at this Tony…
Regards,
Greg
Tony,
This sequence of events happens when I right click on my FSD’s drive letter
symbolic link in Windows Explorer to get the properties menu to display, so
I can share it. I guess it’s explorer doing the IoGetRelatedDeviceObject
ultimately?
I’ll keep plugging away at it - thanks for your help so far!
Greg
I think I fixed the problem…with everyone’s insight here, I discovered
that I was assigning my VPB pointer to the wrong FileObject - now that the
erroneous code is removed, the problem has gone away! I still don’t
understand all of these relationships, but given enough time, I WILL figure
it out…
Thanks again, especially Tony!
regards,
Greg
“Greg Pearce” wrote in message news:xxxxx@ntfsd…
> Tony,
>
> This sequence of events happens when I right click on my FSD’s drive
letter
> symbolic link in Windows Explorer to get the properties menu to display,
so
> I can share it. I guess it’s explorer doing the IoGetRelatedDeviceObject
> ultimately?
>
> I’ll keep plugging away at it - thanks for your help so far!
>
> Greg
>
>
>
Greg,
The purpose of the DIRECT_DEVICE_OPEN is to tell the OS that the file
object does NOT represent an open file, directory, stream, socket,
volume, or other file system level structure. The call in question,
however, indicates that the file object is being used in a path where
this is NOT expected.
I’m having a difficult time understanding exactly how you are getting in
this peculiar state (someone trying to query your volume, but the file
object indicates it is against the device itself.)
Have you confirmed that you do not see this assert when you perform this
operation with NTFS or FAT? If so, the places to focus on are going to
be the creation of this file object and how you maintain the VPB, versus
how the OS does so.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources Inc
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
Sent: Tuesday, May 04, 2004 12:21 PM
To: ntfsd redirect
Subject: Re:[ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
Tony,
I unassembled ObFindHandleForObject and got this:
kd> u nt!ObFindHandleForObject
nt!ObFindHandleForObject:
804a270a 55 push ebp
804a270b 8bec mov ebp,esp
804a270d 83ec10 sub esp,0x10
804a2710 53 push ebx
804a2711 33db xor ebx,ebx
804a2713 56 push esi
804a2714 885dff mov [ebp-0x1],bl
804a2717 64a124010000 mov eax,fs:[00000124]
The Symbol path is this:
srv*c:\symbolstore*http://msdl.microsoft.com/download/symbols;C:\current
\dri
ver7\objchk_w2k_x86\i386
I thought I was getting the right symbols using this method? but
apparently
not.
I dumped out a few control blocks: (and it clearly is my device object
involved, but I still don’t understand the problem…)
kd> dt _FILE_OBJECT 814e4468
+0x000 Type : 5
+0x002 Size : 112
+0x004 DeviceObject : 0x816b9438
+0x008 Vpb : 0x816b93a8
+0x00c FsContext : (null)
+0x010 FsContext2 : (null)
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : (null)
+0x01c FinalStatus : 0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ‘’
+0x025 DeletePending : 0 ‘’
+0x026 ReadAccess : 0 ‘’
+0x027 WriteAccess : 0 ‘’
+0x028 DeleteAccess : 0 ‘’
+0x029 SharedRead : 0 ‘’
+0x02a SharedWrite : 0 ‘’
+0x02b SharedDelete : 0 ‘’
+0x02c Flags : 0x806
+0x030 FileName : _UNICODE_STRING “”
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)
kd> dt _DEVICE_OBJECT 816b9438
+0x000 Type : 3
+0x002 Size : 0xb8
+0x004 ReferenceCount : 1
+0x008 DriverObject : 0x816b9a98
+0x00c NextDevice : 0x816b9558
+0x010 AttachedDevice : (null)
+0x014 CurrentIrp : (null)
+0x018 Timer : (null)
+0x01c Flags : 0x40
+0x020 Characteristics : 0x100
+0x024 Vpb : 0x816b93a8
+0x028 DeviceExtension : (null)
+0x02c DeviceType : 0x24
+0x030 StackSize : 1 ‘’
+0x034 Queue : __unnamed
+0x05c AlignmentRequirement : 0
+0x060 DeviceQueue : _KDEVICE_QUEUE
+0x074 Dpc : _KDPC
+0x094 ActiveThreadCount : 0
+0x098 SecurityDescriptor : 0xe1416568
+0x09c DeviceLock : _KEVENT
+0x0ac SectorSize : 0x200
+0x0ae Spare1 : 0
+0x0b0 DeviceObjectExtension : 0x816b94f0
+0x0b4 Reserved : (null)
kd> dt _VPB 816b93a8
+0x000 Type : 10
+0x002 Size : 88
+0x004 Flags : 1
+0x006 VolumeLabelLength : 0
+0x008 DeviceObject : 0x816b9558
+0x00c RealDevice : 0x816b9438
+0x010 SerialNumber : 0x12345678
+0x014 ReferenceCount : 5
+0x018 VolumeLabel : [32] 0
kd> dt _DRIVER_OBJECT 816b9a98
+0x000 Type : 4
+0x002 Size : 168
+0x004 DeviceObject : 0x816b9438
+0x008 Flags : 0x12
+0x00c DriverStart : 0xbf6f8000
+0x010 DriverSize : 0x13e80
+0x014 DriverSection : 0x816b9bc8
+0x018 DriverExtension : 0x816b9b40
+0x01c DriverName : _UNICODE_STRING “\FileSystem\FTKFSD”
+0x024 HardwareDatabase : 0x80630198
“\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM”
+0x028 FastIoDispatch : 0xbf6fafe0
+0x02c DriverInit : 0xbf709830 ftkfsd!DriverEntry+0
+0x030 DriverStartIo : (null)
+0x034 DriverUnload : 0xbf6fedd0 ftkfsd!DriverExit+0
+0x038 MajorFunction : [28] 0xbf6fe810 ftkfsd!FsdDispatch+0
Thanks a lot for looking at this Tony…
Regards,
Greg
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Greg,
That’d certainly explain it. The file object in question was intended
for a raw device (hence the DIRECT_DEVICE_OPEN bit) but was going to a
file system device. Violates a basic assumption of that particular
routine.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources Inc
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Greg Pearce
Sent: Tuesday, May 04, 2004 2:00 PM
To: ntfsd redirect
Subject: Re:[ntfsd] What does FO_DIRECT_DEVICE_OPEN mean?
I think I fixed the problem…with everyone’s insight here, I discovered
that I was assigning my VPB pointer to the wrong FileObject - now that
the
erroneous code is removed, the problem has gone away! I still don’t
understand all of these relationships, but given enough time, I WILL
figure
it out…
Thanks again, especially Tony!
regards,
Greg
“Greg Pearce” wrote in message news:xxxxx@ntfsd…
> Tony,
>
> This sequence of events happens when I right click on my FSD’s drive
letter
> symbolic link in Windows Explorer to get the properties menu to
display,
so
> I can share it. I guess it’s explorer doing the
IoGetRelatedDeviceObject
> ultimately?
>
> I’ll keep plugging away at it - thanks for your help so far!
>
> Greg
>
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Tony,
Thanks for the explanation in the previous post - that makes more sense now.
Now if I could just figure out why some w2k machines remember my share of
the root, and some do not - but that’s a different post.
Thanks again,
Greg