Re[2]: Re[2]: Re[2]: How to filter the request in MUP?

NTFSD
1

You should read up on how MUP actually works. MUP is the
multi-UNC-Provider so it is the multiplexor for the registered UNC
providers such as the LanMan redirector. When a pre-create request is
first handled for a network share, it is passed to MUP which sends
IOCtls down to the various registered UNC providers to determine which
provider will handle the specific request, it will cache this
information for a period of time so it won’t go through these steps for
future requests to the same target … a little hand waving here. Once
the UNC provider is determined, MUP will no longer be called for the
remaining requests for the FO but are sent directly to the underlying
provider, such as LanMan (see the VPB in the FO).

That said, you actually want to be attaching to the LanMan device, or
whichever redirector you want to filter. In your InstanceSetup callback
you will be called for MUP as well as any UNC provider that is loaded so
here you can select to attach to LanMan, etc. You can see this in tools
such as FileSpy, you have the option to attach to MUP or LanMan …

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: “xxxxx@serpurity.com”
To: “Windows File Systems Devs Interest List”
Sent: 12/7/2017 10:30:00 AM
Subject: RE:[ntfsd] Re[2]: Re[2]: How to filter the request in MUP?

>I just don’t understand why my filter can not catch the following
>request?
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

2

Thanks so much for your explanation, let me try to understand this:
The MUP is just a multiplexor for the registered UNC providers(LanMan redirector in my condition), the mup will only catch the first pre-create request, it determines which provider should handle the following request according to this.
So my encryption filter should let the first pre-create request go without doing any changes, and the following requests(down to LanMan redirector in my condition) should be handled as normal, such as create a file object in the pre-create and substitute for the fake one in all of the following requests.
Am I right? ;-D