Jump-start your project by learning from devs who
write Windows drivers and file systems every day.
Take an OSR seminar!

OSR is Hiring! Click here to find out more.

Windows Internals & Software Drivers Lab, Santa Clara, CA 5-9 August, 2013
Kernel Debugging & Crash Analysis for Windows Lab, Santa Clara, CA 9-13 September, 2013
Upcoming OSR Seminars:
Writing WDF Drivers for Windows Lab, Boston, MA 7-11 October, 2013
Developing File Systems for Windows, Seattle, WA 5-8 November, 2013

Go Back   OSR Online Lists > ntdev
link FileSystem minifilter
Welcome, Guest
You must login to post to this list
  Message 1 of 9  
19 Jul 12 11:43
Alex Funky
xxxxxx@gmail.com
Join Date: 12 Jul 2012
Posts To This List: 24
FileSystem minifilter
Hello! I write filesystem minifilter for backup coping files,but when I recieve IRP_MJ_CREATE for file I'm don't recieve IRP_MJ_CLOSE and sometimes IRP_MJ_CLEANUP... How I can in minifilter catch moment when file copying is ended?
  Message 2 of 9  
19 Jul 12 12:18
Don Burn
xxxxxx@windrvr.com
Join Date: 23 Feb 2011
Posts To This List: 650
Re: FileSystem minifilter
Well first there is a separate group NTFSD for file system questions. Second, when you say you don't receive, what do you mean. If you mean "I did a copy and I did not immediately see a close" then your design assumptions are wrong it can take a long time for the close to occur. If you mean "I did a copy and waited a few days and did not see a close" then your code is wrong. Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr "xxxxx@gmail.com" <xxxxx@gmail.com> wrote in message news:179982@ntdev: > Hello! > > I write filesystem minifilter for backup coping files,but when I recieve IRP_MJ_CREATE for file I'm don't recieve IRP_MJ_CLOSE and sometimes IRP_MJ_CLEANUP... > > How I can in minifilter catch moment when file copying is ended?
  Message 3 of 9  
19 Jul 12 16:41
Alex Funky
xxxxxx@gmail.com
Join Date: 12 Jul 2012
Posts To This List: 24
RE: FileSystem minifilter
Don Burn,sorry but I don't know how to move my subject... I mean "I did a copy and I did not immediately see a close" - at the moment of shutdown OS number of IRP_MJ_CLOSE != number of IRP_MJ_CREATE...
  Message 4 of 9  
19 Jul 12 16:51
Bill Wandel
xxxxxx@bwandel.com
Join Date: 14 Sep 2010
Posts To This List: 87
RE: FileSystem minifilter
Start all over again to the ntfsd list. The IRP_MJ_CLOSE can be delayed. There can be more IRP_MJ_CLOSES than IRP_MJ_CREATEs. Bill Wandel -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com Sent: Thursday, July 19, 2012 4:40 PM To: Windows System Software Devs Interest List Subject: RE:[ntdev] FileSystem minifilter Don Burn,sorry but I don't know how to move my subject... I mean "I did a copy and I did not immediately see a close" - at the moment of shutdown OS number of IRP_MJ_CLOSE != number of IRP_MJ_CREATE... --- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  Message 5 of 9  
19 Jul 12 22:19
Joseph M. Newcomer
xxxxxx@flounder.com
Join Date: 20 Nov 2008
Posts To This List: 1889
Re:FileSystem minifilter
> Well first there is a separate group NTFSD for file system questions. > Second, when you say you don't receive, what do you mean. If you mean > "I did a copy and I did not immediately see a close" then your design > assumptions are wrong it can take a long time for the close to occur. > If you mean "I did a copy and waited a few days and did not see a close" > then your code is wrong. Note that one way this can occur is if there are uncompleted IRPs still active. The I/O Manager will not send a IRP_MJ_CLOSE until it has received completions on all the IRPs it has sent. This means there must never be an execution path that does not do what I term "graceful recovery". For example status = SomeDDICall(...parameters...); if(!NT_SUCCESS(status)) return STATUS_INSUFFICIENT_RESOURCES; is the canonical code sample. Bad switch statements for DeviceIoControl decoding are another. It doesn't take a few days to detect this; after about 5 minutes the I/O Manager returns FALSE to CloseHandle (many people don't notice that CloseHandle is a BOOL). However, the driver will never get a Close IRP. joe > > > Don Burn > Windows Filesystem and Driver Consulting > Website: http://www.windrvr.com > Blog: http://msmvps.com/blogs/WinDrvr > > > > <...excess quoted lines suppressed...>
  Message 6 of 9  
20 Jul 12 04:14
Alex Funky
xxxxxx@gmail.com
Join Date: 12 Jul 2012
Posts To This List: 24
RE: FileSystem minifilter
Ok,but how I can know in minifilter about end of file copying?
  Message 7 of 9  
20 Jul 12 10:14
Scott Noone
xxxxxx@osr.com
Join Date:
Posts To This List: 872
List Moderator
Re: Re:FileSystem minifilter
<xxxxx@flounder.com> wrote in message news:<180019@ntdev>... > It doesn't take a few days to detect this; after about 5 minutes the I/O > Manager returns FALSE to CloseHandle (many people don't notice that > CloseHandle is a BOOL). However, the driver will never get a Close IRP. That's a bug (that Driver Verifier should hopefully catch). The OP is speaking specifically to a behavior they are seeing in a file system filter, where not seeing a close for days/weeks/months/years (though I must admit I've never waited years) is possible under normal conditions. The dangling reference there is usually from Cc/Mm for caching purposes. In that case you won't see a close to the file object until memory pressure dictates or the file system forcibly attempts to purge the data from memory (e.g. during delete processing). -scott -- Scott Noone Consulting Associate and Chief System Problem Analyst OSR Open Systems Resources, Inc. http://www.osronline.com wrote in message news:180019@ntdev... > Well first there is a separate group NTFSD for file system questions. > Second, when you say you don't receive, what do you mean. If you mean > "I did a copy and I did not immediately see a close" then your design > assumptions are wrong it can take a long time for the close to occur. > If you mean "I did a copy and waited a few days and did not see a close" > then your code is wrong. Note that one way this can occur is if there are uncompleted IRPs still active. The I/O Manager will not send a IRP_MJ_CLOSE until it has received completions on all the IRPs it has sent. This means there must never be an execution path that does not do what I term "graceful recovery". For example status = SomeDDICall(...parameters...); if(!NT_SUCCESS(status)) return STATUS_INSUFFICIENT_RESOURCES; is the canonical code sample. Bad switch statements for DeviceIoControl decoding are another. It doesn't take a few days to detect this; after about 5 minutes the I/O Manager returns FALSE to CloseHandle (many people don't notice that CloseHandle is a BOOL). However, the driver will never get a Close IRP. joe > > > Don Burn > Windows Filesystem and Driver Consulting > Website: http://www.windrvr.com > Blog: http://msmvps.com/blogs/WinDrvr > > > > <...excess quoted lines suppressed...>
  Message 8 of 9  
20 Jul 12 10:18
Scott Noone
xxxxxx@osr.com
Join Date:
Posts To This List: 872
List Moderator
Re: FileSystem minifilter
Google: detect file copy site:osronline.com And start reading. We've discussed this a zillion times. Also, as previously mentioned, this is a question for NTFSD and not NTDEV (though do NOT just post this question to NTFSD without first doing your homework). -scott -- Scott Noone Consulting Associate and Chief System Problem Analyst OSR Open Systems Resources, Inc. http://www.osronline.com wrote in message news:180026@ntdev... Ok,but how I can know in minifilter about end of file copying?
  Message 9 of 9  
23 Jul 12 17:20
Maxim S. Shatskih
xxxxxx@storagecraft.com
Join Date: 20 Feb 2003
Posts To This List: 8628
Re: FileSystem minifilter
>don't recieve IRP_MJ_CLOSE You will not see MJ_CLOSE till Cc's garbage collector will decide to destroy the cache map for this file, which can take hours. MJ_CLEANUP should be observed rather soon though. -- Maxim S. Shatskih Windows DDK MVP xxxxx@storagecraft.com http://www.storagecraft.com
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 12:33.

Contact Us - Osr Online Homepage - Top

Copyright ©2012, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license