when opening a file, I will get into PRE_CREATE many times.

NTFSD
1

Hi,
When I open a file/folder, I want to get its fileobject. I get fileobject in PRE_CREATE, but I get into PRE_CREATE many times when I open a file, so I don’t know which fileobject is valid for the file. Hope your help, thank you!

Best Wishes!

2

No, you will only go into PRE_CREATE once per open, it just turns out you
can have multiple opens on a file. What are you trying to do with the
FILE_OBJECT? If you want something that will be common across multiple
opens, look at STREAM_CONTEXT’s in the mini-filter model.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Hi,
> When I open a file/folder, I want to get its fileobject. I get
> fileobject in PRE_CREATE, but I get into PRE_CREATE many times when I
> open a file, so I don’t know which fileobject is valid for the file. Hope
> your help, thank you!
>
> Best Wishes!
>

3

Hi,
“Multiple opens on a file” ? Does it mean a file can have multiple FileObject, becasue when I open a file, I tracked PRE_CREATE, and I found FltObjects->FileObject is not same.

I want to store FileObject in PRE_CREATE and using it in POST_READ and PRE_WRITE, if "FltObjects->FileObject " in PRE_READ or PRE_WRITE is equal to FileObject stored in PRE_CREATE, I am sure the FileObject is valid for the file being read or written.

4

Yes a file can have many file objects. Not only that but thanks to the way
filters work, you may not see all file objects through the create path.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Hi,
> “Multiple opens on a file” ? Does it mean a file can have multiple
> FileObject, becasue when I open a file, I tracked PRE_CREATE, and I found
> FltObjects->FileObject is not same.
>
> I want to store FileObject in PRE_CREATE and using it in POST_READ and
> PRE_WRITE, if "FltObjects->FileObject " in PRE_READ or PRE_WRITE is
> equal to FileObject stored in PRE_CREATE, I am sure the FileObject is
> valid for the file being read or written.
>

5

>Does it mean a file can have multiple FileObject, becasue when I open a
file, I tracked PRE_CREATE, and I found FltObjects->FileObject is not same.

Yes you can have multiple FOs.

amitr0

6

Well,
Thank U! I get it.

In PRE_CREATE, I will get multiple fileobjects for ONE file, but they have same filename, that is, fileobject->filename.

If I want to store the file’s information(fileobject and filename) in PRE_CREATE, which fileobject shuold I store for ONE filename?

Best Wishes!

7

You cannot determine which file_obhect to store, you do not know if that
will be the first or the last to be closed. What do you want to do with
this file_object?

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Well,
> Thank U! I get it.
>
> In PRE_CREATE, I will get multiple fileobjects for ONE file, but they
> have same filename, that is, fileobject->filename.
>
> If I want to store the file’s information(fileobject and filename) in
> PRE_CREATE, which fileobject shuold I store for ONE filename?
>
> Best Wishes!
>

8

They might have trhe same filename but that does not mean that
FileObject->FileName will be the same … basics. It sounds like you want to
use a fltmgr stream context here - oh wait you are doing crypto - how about
OSR DMK?

wrote in message news:xxxxx@ntfsd…
> Well,
> Thank U! I get it.
>
> In PRE_CREATE, I will get multiple fileobjects for ONE file, but they have
> same filename, that is, fileobject->filename.
>
> If I want to store the file’s information(fileobject and filename) in
> PRE_CREATE, which fileobject shuold I store for ONE filename?
>
> Best Wishes!
>

9

>which fileobject shuold I store for ONE filename?

in one sentence…u cant determine!

if u are into encryption/decrption, u aer in for trouble here.