You CAN'T open a file by calling FltCreateFile when file was virtualized by LUAFV ?

NTFSD
1

Hi folks:

Here’s the problem.
The file(a.txt) is virtualized and placed in User\username\appdata\Local\VirtualStore when application tries to create this file in [Program Files] folder. That’s the rule of LUAFV.

I have a mini-filter driver above LUAFV. When application opens the file’s parent directory ( [Program Files]\xxx ) and initiates a QUERY_DIRECTORY request, I call FltQueryDirectoryFile and return result. Yup, file “a.txt” is there, full directory information, LUAFV treats it right.

When application tries to open a.txt, I call FltCreateFileEx. File Not Found? What the heck is going on? Does LUAFV ignore any file open request initiates by mini filter?

2

I am assuming you are doing the create on the path that is coming from the
UAC virtualized application, are you setting OBJ_KERNEL_HANDLE in your
FltCreateFileEx,
I think that is the only way LUAFV can distinguish between a create from
user mode virtualized app vs creates coming from your driver.

On Wed, Jun 19, 2013 at 5:27 PM, <007xgen@163.com> wrote:

Hi folks:

Here’s the problem.
The file(a.txt) is virtualized and placed in
User\username\appdata\Local\VirtualStore when application tries to create
this file in [Program Files] folder. That’s the rule of LUAFV.

I have a mini-filter driver above LUAFV. When application opens the
file’s parent directory ( [Program Files]\xxx ) and initiates a
QUERY_DIRECTORY request, I call FltQueryDirectoryFile and return result.
Yup, file “a.txt” is there, full directory information, LUAFV treats it
right.

When application tries to open a.txt, I call FltCreateFileEx. File Not
Found? What the heck is going on? Does LUAFV ignore any file open request
initiates by mini filter?

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Yes, I’ve set the OBJ_KERNEL_HANDLE.