Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Upcoming OSR Seminars:

Writing WDF Drivers I: Core Concepts, Nashua, NH 15-19 May, 2017
Writing WDF Drivers II: Advanced Implementation Tech., Nashua, NH 23-26 May, 2017
Kernel Debugging and Crash Analysis, Dulles, VA 26-30 June, 2017
Windows Internals & Software Driver Development, Nashua, NH 24-28 July, 2017


Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 10  
03 Aug 17 10:02
hongwei xu
xxxxxx@gmail.com
Join Date: 13 Jul 2017
Posts To This List: 26
Open a file and FileObject(strange)

Hi All, When I opened a file with two different apps, I found they opened the same FileObject. It is really strange. Shouldn't they get two different FileObjects? I map "C:\dir1" to "C:\dir2". It means if an app opens "\dir1\abc.txt", it actually opens "\dir2\abc.txt". When the file is opened in "\dir1\", I attach a streamHandle context to it. If the file is opened in "\dir2\", no streamHandle is attached. But when I try to get streamHandle context from a fileObject opened from "\dir2\", sometimes (not always), I can get a streamHandle. So, how to identify whether a file is opened from "\dir1\" or "\dir2\"? Thanks.
  Message 2 of 10  
03 Aug 17 10:38
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 243
Open a file and FileObject(strange)

<QUOTE> When I opened a file with two different apps, I found they opened the same FileObject. </QUOTE> This is not possible. You either lost IRP_MJ_CLOSE inside your filter or the first open was not successful.
  Message 3 of 10  
03 Aug 17 11:00
hongwei xu
xxxxxx@gmail.com
Join Date: 13 Jul 2017
Posts To This List: 26
Open a file and FileObject(strange)

Hi Slava. Thanks for your reply. >>"You either lost IRP_MJ_CLOSE inside your filter or the first open was not successful." The first open was successful. I did not filter the IRP_MJ_CLOSE. I thinks if a fileObject is closed, its attached StreamHandleContext should be deleted and freed automatically. I used "notepad++.exe" to open a file and attached a streamHandleContext. and open the same file again with "sourceInsight.exe" and did not attached streamhandleContext. But in PreRead, I found I could get streamHandleContext when the current process is "sourceInsight.exe". It's really strange. Have I missed something? Thanks.
  Message 4 of 10  
03 Aug 17 13:09
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 243
Open a file and FileObject(strange)

<QUOTE> Have I missed something? </QUOTE> Yes. Stream and file object are not equal. One stream can have multiple file objects. The system keeps file object to keep data cached. But this doesn't mean that subsequent opens have the same File Object. They have the same stream.
  Message 5 of 10  
03 Aug 17 13:52
hongwei xu
xxxxxx@gmail.com
Join Date: 13 Jul 2017
Posts To This List: 26
Open a file and FileObject(strange)

Hi Slava, Thanks for your reply. I really appreciate it. I agree with you that stream and fileObject are different. So I used streamHandle context. I did another experiment, the result indicated that after a FileObject was cleanup but before closed, the FileObject could be opened again. 1. when a file is opened by explorer.exe or notepad++.exe, a streamHandle context is attached to the FileObject. 2. when the same file is opened again by wordpad.exe, do not attach streamHandle context to the new FileObject. 3. 3.1 If I do NOT delete streamHandle contexts in IRP_MJ_CLEANUP, then sometimes in PreRead, when the current process is wordpad.exe, FltGetStreamHandleContext() returns success. As mentioned above, stream handle contexts are only attached for FileObjects opened by explorer.exe and notepad++.exe. 3.2 If I delete streamHandle contexts in IRP_MJ_CLEANUP, when the current process is wordpad.exe, FltGetStreamHandleContext() always fail. I think the results indicate that: 1. after cleanup, before close, the fileObject with a streamHandle context is opened again by wordpad.exe. so, even if no new streamHandle context is set, we can get the old one. Tomorrow I am going to do more experiments. Thanks.
  Message 6 of 10  
03 Aug 17 15:24
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 243
Open a file and FileObject(strange)

<QUOTE> I did another experiment, the result indicated that after a FileObject was cleanup but before closed, the FileObject could be opened again. </QUOTE> Nobody here will give any reasonable explanation for FILE_OBJECT reuse without IRP_MJ_CLOSE as it doesn't exist. The system doesn't work this way. If you believe you have found a bug report it to Microsoft.
  Message 7 of 10  
05 Aug 17 05:27
rod widdowson
xxxxxx@steadingsoftware.com
Join Date: 11 Sep 2006
Posts To This List: 810
Open a file and FileObject(strange)

I assume that at this stage you have dismissed paging IO from the loop? What you describe would happen as a matter of course if you opened the file on one path and established the cache with it, and then did cached operations via the other path.
  Message 8 of 10  
08 Aug 17 06:11
hongwei xu
xxxxxx@gmail.com
Join Date: 13 Jul 2017
Posts To This List: 26
Open a file and FileObject(strange)

Thank you Rod. >>"I assume that at this stage you have dismissed paging IO from the loop?" Sorry, what did you mean? I dealt with the Paging IO in READ and WRITE. >>"What you describe would happen as a matter of course if you opened the ..." Is there any way that can identify which path is a fileObject opened on, "\dir1\" or "\dir2\"? Thanks.
  Message 9 of 10  
08 Aug 17 12:11
rod widdowson
xxxxxx@steadingsoftware.com
Join Date: 11 Sep 2006
Posts To This List: 810
Open a file and FileObject(strange)

>>"I assume that at this stage you have dismissed paging IO from the loop?" Sorry, what did you mean? I dealt with the Paging IO in READ and WRITE. Right - so in the READ path you may be handling (at top level) a read from \dir1\, but in the context of your CcCopyRead you'll get a paging read form \dir2\. That's all I meant.
  Message 10 of 10  
09 Aug 17 03:47
hongwei xu
xxxxxx@gmail.com
Join Date: 13 Jul 2017
Posts To This List: 26
Open a file and FileObject(strange)

Thanks Rod. I really appreciate your reply.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 15:38.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license