Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 4  
06 Nov 17 11:22
Gaurav Khuntale
xxxxxx@gmail.com
Join Date: 05 Sep 2014
Posts To This List: 18
Query about requester process id in disk filter driver

Hello, I am working on disk filter driver. After doing some research i understood that, for disk read/write operations its not possible to get actual requester process id every time in disk filter driver. But my question is, is it possible to get actual requester process id for operations like add partition, remove partition? Does these operations always happens in the context of calling process itself? Kindly help me to understand this better. Thanks, Gaurav
  Message 2 of 4  
06 Nov 17 11:39
Jamey Kirby
xxxxxx@gmail.com
Join Date: 31 Dec 2014
Posts To This List: 49
Query about requester process id in disk filter driver

Nope. You cannot rely on knowing the process at the disk level. They've been decoupled by Windows for obvious reasons of design, and simplicity. If you need to deal with processes, you'll need to be filtering at the file system level. On Mon, Nov 6, 2017 at 11:23 AM xxxxx@gmail.com < xxxxx@lists.osr.com> wrote: > Hello, > > I am working on disk filter driver. After doing some research i understood > that, for disk read/write operations its not possible to get actual > requester process id every time in disk filter driver. > > But my question is, is it possible to get actual requester process id for > operations like add partition, remove partition? Does these operations > always happens in the context of calling process itself? > <...excess quoted lines suppressed...> --
  Message 3 of 4  
06 Nov 17 14:12
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 264
Query about requester process id in disk filter driver

<QUOTE> But my question is, is it possible to get actual requester process id for operations like add partition, remove partition? Does these operations always happens in the context of calling process itself? </QUOTE> I assume you are talking about a normal mode of operation, i.e. a user mode application partitions a drive. This is a direct disk IO in the context of a calling thread through a RAW file system which is a pass through driver. The process context is valid at the RAW FSD level and at the top of a disk driver stack. The process context validity depends on the filter's position in the stack. If a filter is at the top of the stack it receives direct IO requests from a RAW FSD in the caller's context. Alternatively, you can extend the design with a file system minifilter that is attached atop of a RAW FSD object. There might be a degenerate case when a third party minifilter redirects direct IO requests to a kernel thread. In that case you have to attach your minifilter above this one.
  Message 4 of 4  
07 Nov 17 01:25
Gaurav Khuntale
xxxxxx@gmail.com
Join Date: 05 Sep 2014
Posts To This List: 18
Query about requester process id in disk filter driver

Thank you Jamey and Slava for the response. Basically i want to monitor MBR modification, Partition modification operations and for that i want to classify those operations based on which process is doing that operation. If i straight away block those operations, then i am afraid that legitimate process will unable to do there work.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 00:35.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license