Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 7  
01 Nov 17 07:47
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Separation of Concerns in a filesystem minifilter

Hi, I have a filesystem minifilter driver which implements a set of distinct functionalities which I would like to be able to logically separate for development and support purposes. It would be desirable to provide our Support team with a mechanism to disable certain features but leave others enabled. The different features require the use of a different set of call-backs and the call-backs required for the features will partially overlap. As a simple example Feature A needs IRP_MJ_CREATE, IRP_MJ_WRITE and IRP_MJ_CLOSE Feature B needs IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_READ and IRP_MJ_CLOSE So my question is how to best achieve this separation of concerns? - To split this functionality out into separate drivers would result in a possibly large number of drivers. - Adding ad hoc code to the driver to control individual features would probably get messy. - Assigning a set of dedicated call-backs to each particular feature would involve writing a framework to pass IRPs between the different callbacks (e.g. present an IRP_MJ_WRITE to Feature A's write callback then Feature B's write callback) in a similar way to the filter manager, which is reinventing the wheel. Any advice on how best to go about this would be appreciated. Thanks, Ian.
  Message 2 of 7  
02 Nov 17 21:32
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 942
List Moderator
Separation of Concerns in a filesystem minifilter

Interesting problem with no right answer of course... Just to give you another option to look at, note that you can register one minifilter driver at multiple different altitudes (see the Minispy sample). You can also break your single "official" altitude into multiple sub-altitudes (e.g. 370000.0, 370000.1, 370000.2, etc). So, you could have your different features at different altitudes and attach/detach them as necessary. This effectively gets your option 3 "for free" because FltMgr will dispatch each operation to your multiple instances. I'm not saying this is a perfect option, but something else to think about. -scott OSR @OSRDrivers
  Message 3 of 7  
09 Nov 17 08:14
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Separation of Concerns in a filesystem minifilter

That's perfect Scott. Thanks very much! Ian.
  Message 4 of 7  
09 Nov 17 11:34
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Separation of Concerns in a filesystem minifilter

OK, I have played with minispy but I don't understand how it shows me how to create multiple instances. I can see the registry entries for the additional instances but when I run it I only see one. What do I need to do to load the middle and bottom instances? Here's my output: >/a c: Attaching to c:... Instance name: Minispy - Top Instance >/l Dos Name Volume Name Status -------------- ------------------------------------ -------- \Device\Mup C: \Device\HarddiskVolume2 Attached \Device\NamedPipe \Device\Mailslot \Device\HarddiskVolume1 C:\Windows\system32>fltmc instances Filter Volume Name Altitude Instance Name Frame SprtFtrs VlStatus -------------------- ------------------------------------- ------------ ---------------------- ----- -------- -------- FileInfo 40500 FileInfo 0 00000003 FileInfo C: 40500 FileInfo 0 00000003 FileInfo \Device\Mup 40500 FileInfo 0 00000003 Minispy C: 385100 Minispy - Top Instance 0 00000007 WdFilter 328010 WdFilter Instance 0 00000007 WdFilter C: 328010 WdFilter Instance 0 00000007 WdFilter \Device\Mup 328010 WdFilter Instance 0 00000007 : : Thanks, Ian.
  Message 5 of 7  
10 Nov 17 09:00
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Separation of Concerns in a filesystem minifilter

To (partly) answer my own question, I had to change the InstanceX.Flags entries in the inf file to allow automatic attachments. I now get one call to DriverEntry plus one per instance to an InstanceSetup callback I added and of course I see the different PFLT_INSTANCE pointers passed in the PCFLT_RELATED_OBJECTS parameter of my callbacks. This is all good but how do I achieve the different features at different altitudes? Would this be a case of checking the PFLT_INSTANCE pointer in each callback or can I change the list of IRP callbacks on a per-instance basis? Thanks, Ian.
  Message 6 of 7  
15 Nov 17 07:14
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 942
List Moderator
Separation of Concerns in a filesystem minifilter

(Sorry, been away) <QUOTE> Would this be a case of checking the PFLT_INSTANCE pointer in each callback... </QUOTE> This. The callbacks are global to the filter, so you do different processing at the different instances. -scott OSR @OSRDrivers
  Message 7 of 7  
17 Nov 17 10:19
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Separation of Concerns in a filesystem minifilter

No problem. Thanks again Scott.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 00:35.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license