Hello Ntfsd,
We have a legacy file system filter driver which has a per stream context
set ( through FSRTL*streamcontext api) to keep track of changes happening
on files, we are running into an odd situation where for some files on
which we have per...
↧
Query regarding teardown callback
↧
Minifilter instance setup callback is calling at DPC level?!
I have very strange, as for me, fail, for some reason instance setup callback i called at DPC level. As I know it should be always at passive level msdn: http://msdn.microsoft.com/en-us/library/windows/hardware/ff551096%28v=vs.85%29.aspx.
Here the !...
↧
↧
FltControlFile returns STATUS_NOT_IMPLEMENTED (2 msgs)
I am trying to aquire oploack from my PreCreate() in minifilter which is basically a virtulization driver for file level backup.but after calling FltFsControlFile(...,FSCTL_REQUEST_FILTER_OPLOCK,...);call is failing with operation not implemented. so...
↧
Why MS does not recommend to use memory section on the CSV volumes?
I have memory mapped file that i am using on target volume.
For CSV volume - I read from the Vladimir Petter (Microsoft) storage conference notes:
"Avoid building memory sections. Violation - stale cache and stream corruption." at the same time one ...
↧
can this be optimized (path block in pre/post create) ?
Hi,
I need to protect all files in some local directories from modification as part of a self-protection package of a malware scanner.
I use the normalized name so far. According to this forum this is slow in pre create. So I handle the destructiv...
↧
↧
Data corruption because of unexpected paging read (4 msgs)
I am creating a file system driver which is similar to fastfat in WDK smaples.
And I got problem when I doing following test, and data is corrupted.
I did some search in this forum, but I cannot find a explanation why following issue happens. :(
Hav...
↧
no paging writes if file reopened with readonly after cleanup (2 msgs)
Hi! ,
At a customer site that has been experiencing a certain problem for over one year (!), I have narrowed down the problem.
Scenario is:
1. A series of normal writes to a file opened with buffering occur.
2. IRP_MJ_CLEANUP occurs.
3. File is re-...
↧
UAC, IE and alternate data streams access denied
Has anyone else come across IE being denied access to alternate data
streams when UAC is turned on? The same issue does not happen when IE is
Ran as Admin, even though the UAC is on. It does not happen with other apps
that are not ran with elevated p...
↧
How to set Wait parameter in CcCopyWrite?
Hi, I'm developing an encryption filter based on minifilter with shadowFileObject tech.
Now I'm a little confused about CcCopyWrite, I call CcCopyWrite in IRP_MJ_WRITE PreRoutine for cached IO with Wait = TRUE.
But I wonder when should I set Wait = F...
↧
↧
FLTFL_IO_OPERATION_NON_CACHED flag fails for unaligned length on 2012 R2 and win8.1
I am writing a mini filter driver.
I use FltWriteFile with FLTFL_IO_OPERATION_NON_CACHED flag.
When I try to write data beyond EOF for eg
Let says I create a file, file size is 0 till now and I try to write 64 bytes(basically less than sector size) ...
↧
upper limit on max-connections in FltCreateCommunicationPort
Hi,
Is there an upper limit on the number of connections (MaxConnections)
parameter to FltCreateCommunicationPort ? Is there an upper limit based on
best-practices / thumb rules etc ? MSDN says it should be greater than 0.
Thanks,
--
...
↧
Interwoven developers
If anybody from the kernel team for HP's Interwoven Suite (notably iwfsd.sys) is on the forum could they PM about a mutual customer issue
Cheers
Mark
...
↧
Where's the read? (2 msgs)
So slightly misleading question because I recognize it is probably a caching issue. But it is frustrating me none-the-less. First, I am testing a minifilter on two systems; one physical and one VM. Both are Windows 7 x64 with similar builds. So t...
↧
↧
How to deal with IRP_MJ_ACQUIRE_FOR_MOD_WRITE? (3 msgs)
Hi all, I meet a problem and I have been debug it for a long time, but did not find anything useful.
I'm doing an encryption filter based on layered fsd, the filter runs well for normal write requests, but it seems go into a deadlock when it meets a ...
↧
How could the DbgPrint cause CLOCK_WATCHDOG_TIMEOUT?
I am using FltQueueGenericWorkItem on preWrite callback to queue work item, that will log changes in some file.
I have a check there :
if (FlagOn(filterData.Flags, DATA_FLAG_PAUSED))
{
DebugTrace(DEBUG_TRACE_WARNING,
("MyFilter!WriteCha...
↧
FltSetInformationFile (FileEndOfFileInformation) returns with ACESS_DENIED on network (2 msgs)
I am working on a minifilter and i am trying to extend the file size in precreate by FltSetInformationFile(FileEndOfFileInformation), but i am getting ACCESS_DENIED. The file is opened with only FILE_APPEND_DATA Desired access. This same thing is wor...
↧
LayeredFSD and different support routines for AcquireForReadAhead? (3 msgs)
Hi all, I'm learning fastfat source and NT4(Windwos 2000) source recently.
From NT4 source I learn that differnt FS(FastFat, CdFs, NTFS, etc.) have different support routines for AcquireForReadAhead. For example, the support routine for NTFS try to a...
↧
↧
KES10 and FltGetFileNameInformation()
Hello guys!
I faced with problem in my file system minifilter when Kaspersky Endpoint Security 10 installed on PS : function FltGetFileNameInformation() return in all callback's (IRP_MJ_CREATE,IRP_MJ_DIRECTORY_CONTROL) STATUS_FLT_INVALID_NAME_REQUEST...
↧
RESOURCE_NOT_OWNED and Thread
I got a dump and it shows as following.
I don't know where was wrong, the !analyze -v says RESOURCE_NOT_OWNED, but
the !locks -v 0x8673ea34 says the resource is owned by the target thread...
kd> !analyze -v
******************************************...
↧
NTFS_FILE_SYSTEM in FltReadFile ? (3 msgs)
hi
i use FltReadFile in IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION pre operation
for all files it work good but for some file i get NTFS_FILE_SYSTEM
after i search for solution i find checking PagingIoResource but it dont work and i get BSO...
↧