Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

OSR Seminars


Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 5  
20 Oct 11 05:51
Utsav Agarwal
xxxxxx@gmail.com
Join Date: 26 Feb 2011
Posts To This List: 28
FltCreateFile or ZwCreateFile

Hi I have written a file system mini filter driver and registered preCreate and postCreate callbacks. In these callbacks I am writing logs in a text file using ZwCreateFile and ZwWriteFile. This is working fine. Why don't I get the calback for this ZwCreateFile? Shouldn't I use FltCreateFile and FltWriteFile?
  Message 2 of 5  
20 Oct 11 06:29
Don Burn
xxxxxx@windrvr.com
Join Date: 23 Feb 2011
Posts To This List: 175
FltCreateFile or ZwCreateFile

You don't get the callback because the minifilter support handles the ZwXXX calls and FltXXX calls so they only go down the stack to the lower drivers. Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr "xxxxx@gmail.com" <xxxxx@gmail.com> wrote in message news:92228@ntfsd: > Hi > > I have written a file system mini filter driver and registered preCreate and postCreate callbacks. In these callbacks I am writing logs in a text file using ZwCreateFile and ZwWriteFile. > This is working fine. > Why don't I get the calback for this ZwCreateFile? > Shouldn't I use FltCreateFile and FltWriteFile?
  Message 3 of 5  
20 Oct 11 08:05
Utsav Agarwal
xxxxxx@gmail.com
Join Date: 26 Feb 2011
Posts To This List: 28
FltCreateFile or ZwCreateFile

Then why is FltCreateFile given when ZwCreateFile is already there?
  Message 4 of 5  
20 Oct 11 11:16
Alex Carp
xxxxxx@gmail.com
Join Date: 23 Feb 2010
Posts To This List: 981
FltCreateFile or ZwCreateFile

If you open the file using ZwCreateFile you should see an IRP_MJ_CREATE for it. If you open the file using FltCreateFile(Ex(2)) then you won't see the IRP_MJ_CREATE. Please note that the right way to open the handle from a minifilter while processing an IO request is via FltCreateFile, ZwCreateFile will create interesting problems, like infinite loops and deadlocks. I don't know why you're not seeing your create callback but there could be many factors and i don't know if it's worth investigating since you should be using FltCreateFile anyway. I wrote a post on the topic of when to use Flt and when to use Zw calls, here (http://fsfilters.blogspot.com/2010/02/issuing-io-in-minifilters-part-1.html and http://fsfilters.blogspot.com/2010/02/issuing-io-in-minifilters-part-2-flt-vs.htm l). Thanks, Alex.
  Message 5 of 5  
24 Oct 11 08:49
Utsav Agarwal
xxxxxx@gmail.com
Join Date: 26 Feb 2011
Posts To This List: 28
FltCreateFile or ZwCreateFile

Thanks Alex :)
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 17:19.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license