What is FASTIO_QUERY_INFORMATION

NTFSD
1

All,

I have a simple test code it goes as follows:

HANDLE hFile;
hFile = CreateFile( NameBuffer,
GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_DELETE_ON_CLOSE,
NULL);

LARGE_INTEGER QueriedSize;

memset(&QueriedSize, 0, sizeof(LARGE_INTEGER));

GetFileSizeEx(hFile, &QueriedSize);

This shows up logs in ProcMon as follows:

IRP_MJ_CREATE On the File pointed to by NameBuffer
FASTIO_QUERY_INFORMATION Type : QueryStandardInformationFile

In My mini filter I am looking into IRP_MJ_SET_INFO and IRP_MJ_QUERY_INFO,
so in the Pre-Op for the Query Handler,

*should I expect to hit my break point when FASTIO_QUERY_INFORMATION comes?*

The handler is registered as follows:

{ IRP_MJ_QUERY_INFORMATION,
0,
MyQueryPreOp,
MyQueryPostOp },

Because it doesn’t come as all, yet the requst for FASTIO suceeds.

If this is not the right way to handle it, please do let me know what I am
doing incorrectly?

thanks

Al

2

No, that should work. There should be a flag to tell that the operation was a FASTIO but other than that it should work.

However, please note that sometimes the mapping between the FASTIO and the FltMgr IRP_MJ_XXX function isn’t the obvious one and I’ve been bitten by this a couple of times. So what I’m trying to say is that it’s possible that the FASTIO_QUERY_INFORMATION actually maps to a different IRP_MJ_XXX function. Unfortunately I don’t remember if FASTIO_QUERY_INFORMATION actually maps to IRP_MJ_QUERY_INFORMATION or something else, so you’d probably have to figure that out. It could also be that you’re doing something wrong and filtering the operation for some reason :).

In any case I would start by taking the passthrough sample and changing it a bit to print all the operations it sees for your filename, which should tell you which IRP_MJ_XXX function gets called. From there you can start investigating where your minifilter is doing things differently.

Thanks,
Alex.
On May 9, 2013, at 7:50 AM, A P wrote:

> All,
>
> I have a simple test code it goes as follows:
>
> HANDLE hFile;
> hFile = CreateFile( NameBuffer,
> GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE,
> NULL,
> CREATE_ALWAYS,
> FILE_ATTRIBUTE_NORMAL | FILE_FLAG_DELETE_ON_CLOSE,
> NULL);
>
> LARGE_INTEGER QueriedSize;
>
> memset(&QueriedSize, 0, sizeof(LARGE_INTEGER));
>
> GetFileSizeEx(hFile, &QueriedSize);
>
>
>
> This shows up logs in ProcMon as follows:
>
> IRP_MJ_CREATE On the File pointed to by NameBuffer
> FASTIO_QUERY_INFORMATION Type : QueryStandardInformationFile
>
>
>
> In My mini filter I am looking into IRP_MJ_SET_INFO and IRP_MJ_QUERY_INFO, so in the Pre-Op for the Query Handler,
>
> should I expect to hit my break point when FASTIO_QUERY_INFORMATION comes?
>
> The handler is registered as follows:
>
> { IRP_MJ_QUERY_INFORMATION,
> 0,
> MyQueryPreOp,
> MyQueryPostOp },
>
>
> Because it doesn’t come as all, yet the requst for FASTIO suceeds.
>
> If this is not the right way to handle it, please do let me know what I am doing incorrectly?
>
> thanks
>
> Al
> — NTFSD is sponsored by OSR OSR is hiring!! Info at http://www.osr.com/careers For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer