I am working on minifilter having shadow file object. For IRP_MJDIRECTORY_CONTROL (NotifyChangeDirectory ) i am sending the request to lower FSD in preFunction, this is working fine for local File system but for remote File system this call is gettin...
↧
NotifyChangeDirectory Hang for remote File System
↧
Driver sometimes unloaded on Windows XP (3 msgs)
I have strange problem when driver sometimes unable unregisters on XP:
1. The problem occurs only on XP, not on Windows 7 kernel.
2. All communication ports are closed before (unfortunately FltCloseCommunicationPort() has not return code).
But (onl...
↧
↧
Read file in Another Volume in Post Create (6 msgs)
hi
my minifilter register post create and in that i want to check if any process access to my file and read process file , file and process maybe should be on different volumes
for example file is on d:\myfile.jpg and process is c:\m...
↧
Re: Read file in Another Volume in Post Create (3 msgs)
thanks
FltCreateFile need volume instance so If this parameter is *NULL*, the
request is sent to the device object at the top of the file system driver
stack for the volume. If it is non-*NULL*, the request is sent only to
minifilter driver instan...
↧
Differentiation between write on an existing file and when a new file is created (3 msgs)
In my mini filter driver, I want to differentiate between write which happens when a new file is created and when a write happens on the existing file. In case of the existing file, on write I am performing some operation however I want to avoid the ...
↧
↧
Zombie process (2 msgs)
Hi
The product that i work on has a minifilter driver and couple of plugin drivers. I have come across a case where the customer when trying to run few of its batch processes, the system becomes very sluggish over a period of time.
The forced cra...
↧
Which resource should I acquire for AcquireForCreateSection?
Hi, I'm developing an isolation filter.
I try to build my own resource acquired algorithm, but I do know which resource should I require for AcquireForCreateSection, I have read the fastfat source but found nothing about this kind of request.
Any hel...
↧
Deleting an executable on remote File system gives Delete pending
am working on minifilter based on shadow file. i am attached on MUP, i deleted an executable file on remote FS then copied same file again i am getting DELETE_PENDING on that till the system restart. When i give DELETE flag in Desired Acess it works ...
↧
Should I enter into CriticalRegion in CcCallbacks?
Hi, from the reference of WDK, I learn that Normal kernel APC delivery must be disabled before calling ExAcquireResourceXXX.
In my design, my filter try to acquire PagingIoResource shared by calling ExAcquireResourceSharedLite, according to the refer...
↧
↧
Dead Lock in MiMappedPageWriter? (4 msgs)
During testing against my filter dirver, I encounter a deadlock in MiMappedPageWriter.
From the output of !locks, I found 3 resources, just as follows:
kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks.......
Resource @ 0...
↧
Strange load error (7 msgs)
Hi,
I am trying to load a Win32 sys driver on Win7 32-bit platform. I am using
Win7 32-bit Release Build for my profile. I get this error that does not
seem to be in OSR archives or on Google. I can't seem to locate a list of
'reasons'. Any idea?
c...
↧
How to extend EOF in Isolation Filter? (3 msgs)
I'm confused about one question - how to extend EOF in pre-write routine in Isolation Filter?
Several days before, I asked a question about how to deal with RESOURCES in Isolation Filter, from that post I learned that I should allocate RESOURCES in m...
↧
question on persisting WPP tracing using Autologger across reboots
Hi,
I am using WPP logging from my minifilter and am setting it up using
Autologger. I find that it is not persisted across reboots. The file is
cleaned up every time the machine is restarted. I am tying to find out
options to have a behavior which ...
↧
↧
Does Mapped Page Writer run with APC Disabled? (2 msgs)
I found that MiMappedPageWriter may stop working when a thread called FltClose and FltClose is waiting to acquire the PagingIoResource exclusively.
Is it because FltClose disables Normal APCs? And I wonder why Mapped Page Writer does not disables Nor...
↧
Reading digital signature of self from DriverEntry of boot start driver... (5 msgs)
Hello,
I have a digitally signed mini-filter that is configured to load as a boot start driver.
From DriverEntry of this mini-filter, I want to read the digital signature that is stored in the driver binary file.
I see that, the digital signature...
↧
Registration for IFS Plugfest 27 is open
Hello,
We are pleased to inform you that IFS Plugfest 27 has been scheduled. Here are some preliminary event details:
When
Monday, March 30th to Friday, April 3rd, 2015. The event begins at 9am and ends at 6pm each day, except for Friday when it ...
↧
=?utf-8?Q?Creat...e_object?=
Out of interest, when creating shadow file objects for isolation filters, what does everyone prefer; IoCreateStreamFileObject or FltCreateFile?
For those of you who use IoCreateStreamFileObject, which fields of the FILE_OBJECT do you normally fi...
↧
↧
RE: Creating a shadow file object
http://www.osronline.com/showthread.cfm?link=260118
Tony explains a little bit of the differences between the two. I've just used FltCreateFile for SFO for no other reason than it was a minifilter and it seems that minifilters should use FltXXX fun...
↧
NTFS zero-fill not seen as paging IOs
Hi,
I have a question about how NTFS will 0-fill a file if you SetEndOfFile further down and then write at that new EOF.
1. Create a new file on an NTFS volume without specifying no buffering, so will use buffered IO.
2. SetFilePointer to 0x1000403....
↧
Understanding the behavior of CcCoherencyFlushAndPurgeCache (4 msgs)
Hi All,
I would like to understand the behavior of CcCoherencyFlushAndPurgeCache in
the following scenario:
1. I have a memory-mapped file with caching/buffering enabled.
2. I have not executed CcInitializeCacheMap on the file.
3. After doing some ...
↧
