FltCreateFileEx returns a FileObject which is not used during IO

NTFSD
1

Hi,
In our minifilter we get a FileObject of a file we are interested in by calling FltCreateFileEx.
When IO is received in the ReadPreOperation routine - I see that the FltObjects->FileObject is different from the one I have received from FltCreateFileEx (although this is the same file).
Anyone knows how can I get from FltCreateFileEx or other API the real FileObject (the one which will be used in FltObjects->FileObject of the ReadPreOperation routine?
Thanks,
Ron

2

The FileObject which is passed to the dispatch routines depends on the
operation. For paging IO operations you will see the file object which
was used by the file system to initialize caching on the file, which may
or may not be the file object processed in the create processing. This
is because some file systems, such as NTFS, create stream file objects
to initialize caching. Thus the file object you get back from the
FltCreateFileEx API, which is the one you would see in the pre-post
create processing, would not be the same as the one you would see in the
prewrite or preread routines for paging IO. As well for some of the
query-set file_info requests, the MM/CM modules will use the fileobject
used to initialize caching.

Pete

On 4/13/2014 1:57 PM, xxxxx@walla.co.il wrote:

Hi,
In our minifilter we get a FileObject of a file we are interested in by calling FltCreateFileEx.
When IO is received in the ReadPreOperation routine - I see that the FltObjects->FileObject is different from the one I have received from FltCreateFileEx (although this is the same file).
Anyone knows how can I get from FltCreateFileEx or other API the real FileObject (the one which will be used in FltObjects->FileObject of the ReadPreOperation routine?
Thanks,
Ron

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295