Why FILE_OBJECT = NULL when IRP_MJ_READ ??

NTFSD
1

Hi all
My Problem is that …I want to monitor the file I/O in my usb storage
device
so, I want to know which file is read and wrote, so I filter the IRP_MY_READ
and IRP_MJ_WRITE and get PFILE_OBJECT from IO)STACK_LOCATION
but it is alway be NULL pointer why ??
can any one tell me ??

2

Storage Driver is not a File System Driver. Storage driver takes care of the
sector address, not the file address.

Best regards,
lu0
TTC Senior Engineer
http://ttcone.com
Inside Programming
http://lu0.126.com
----- Original Message -----
From: “Shuo-Da Huang(¶ÀºÓ¹F)”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, September 03, 2004 10:01 AM
Subject: [ntfsd] Why FILE_OBJECT = NULL when IRP_MJ_READ ??

> Hi all
> My Problem is that …I want to monitor the file I/O in my usb storage
> device
> so, I want to know which file is read and wrote, so I filter the
> IRP_MY_READ
> and IRP_MJ_WRITE and get PFILE_OBJECT from IO)STACK_LOCATION
> but it is alway be NULL pointer why ??
> can any one tell me ??

3

I have a little confuse about am I mounting my filter driver to a usb
storage device or a file system, I install my filter driver by INF file and
I indicate
two sys file in the INF file, one is filter.sys(my filter driver) the other
one
is disk.sys which is copied from c:\windows\system32\driver
am I doing something wrong ?
“lu0” ÔÚà]¼þ news:xxxxx@ntfsd ÖÐ׫Œ‘…
> Storage Driver is not a File System Driver. Storage driver takes care of
the
> sector address, not the file address.
>
> Best regards,
> lu0
> TTC Senior Engineer
> http://ttcone.com
> Inside Programming
> http://lu0.126.com
> ----- Original Message -----
> From: “Shuo-Da Huang(¶ÀºÓ¹F)”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Friday, September 03, 2004 10:01 AM
> Subject: [ntfsd] Why FILE_OBJECT = NULL when IRP_MJ_READ ??
>
>
> > Hi all
> > My Problem is that …I want to monitor the file I/O in my usb storage
> > device
> > so, I want to know which file is read and wrote, so I filter the
> > IRP_MY_READ
> > and IRP_MJ_WRITE and get PFILE_OBJECT from IO)STACK_LOCATION
> > but it is alway be NULL pointer why ??
> > can any one tell me ??
>
>
>
>