Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 2  
07 Dec 17 06:18
destiny
xxxxxx@gmail.com
Join Date: 07 Dec 2017
Posts To This List: 1
FsRtlCreateSectionForDataScan

Hi! I need to read the whole file in the minifilter driver. For now I need it in the post-create callback, but I plan to sometimes do it in the pre-read callback. For windows 8+ I want to use FltCreateSectionForDataScan, but the driver should work on windows 7 as well. As far as I understand after looking at the code of FltCreateSectionForDataScan, it is an extended version of FsRtlCreateSectionForDataScan, with some additional IRP queuing mechanism to avoid access problems on the file, for which the section is created. I don't care about this that much, since I actually want to lock the file until I process it, so on windows 7 I would just opt in for the FsRtl-function. The problem I am trying to understand is what is the line "Important The FsRtlCreateSectionForDataScan routine should only be used in cases where a handle to the file object specified in the FileObject parameter has not yet been created (typically while processing a post-create operation)" on MSDN means. It makes me think that actually I shall implement the following: 1) if FltCreateSectionForDataScan is available, use it; 2) if FO_HANDLE_CREATED is set in the post-create, or if i am in the pre-read, then use ObOpenObjectByPointer + ZwCreateSection on the file object; 3) if FO_HANDLE_CREATED is not set in the post-create, then use FsRtlCreateSectionForDataScan. Does it make sense, or did I miss some scenarios/possibilities? Thanks!
  Message 2 of 2  
Today 15:34
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 946
List Moderator
FsRtlCreateSectionForDataScan

<QUOTE> 1) if FltCreateSectionForDataScan is available, use it; </QUOTE> Yes <QUOTE> 2) if FO_HANDLE_CREATED is set in the post-create, or if i am in the pre-read, then use ObOpenObjectByPointer + ZwCreateSection on the file object; </QUOTE> FO_HANDLE_CREATED won't be set in post-create. The handle can't be created until the create request completes. And what's the point of doing this in pre-read? Why not wait until post-read? -scott OSR @OSRDrivers
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 21:41.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license