Message 1 of 2
07 Dec 17 12:46
Join Date: 17 Feb 2012
Posts To This List: 686
Re: Re: Re: How to filter the request in MUP?
You should read up on how MUP actually works. MUP is the
multi-UNC-Provider so it is the multiplexor for the registered UNC
providers such as the LanMan redirector. When a pre-create request is
first handled for a network share, it is passed to MUP which sends
IOCtls down to the various registered UNC providers to determine which
provider will handle the specific request, it will cache this
information for a period of time so it won't go through these steps for
future requests to the same target ... a little hand waving here. Once
the UNC provider is determined, MUP will no longer be called for the
remaining requests for the FO but are sent directly to the underlying
provider, such as LanMan (see the VPB in the FO).
That said, you actually want to be attaching to the LanMan device, or
whichever redirector you want to filter. In your InstanceSetup callback
you will be called for MUP as well as any UNC provider that is loaded so
here you can select to attach to LanMan, etc. You can see this in tools
such as FileSpy, you have the option to attach to MUP or LanMan ...
Windows File System and Device Driver Consulting
------ Original Message ------
To: "Windows File Systems Devs Interest List"
Sent: 12/7/2017 10:30:00 AM
Subject: RE:[ntfsd] Re: Re: How to filter the request in MUP?
>I just don't understand why my filter can not catch the following
>NTFSD is sponsored by OSR
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
<...excess quoted lines suppressed...>