As mentioned in title, I would like to know how to get the file path from FILE_OBJECT. I know this is not a new problem, so I have read articles and source code(FileMon, MiniSpy) about this question before ask for help, but my question still not be solved.
I want to get the path of the file in the pre-routine of read/write, FltGetFileNameInformation can not work at PagingIO, FILE_OBJECT will be modified during the filesystem operation and thus I can not reference filename by sha1(FILE_OBJECT).
I wonder is there any method can get the path of the file in pre read/wirte routine? Any help will be appreciated!
Get name during create and create a file context. Query the context during
pre read/write.
On Sun, Aug 17, 2014 at 10:53 PM, wrote:
> As mentioned in title, I would like to know how to get the file path from
> FILE_OBJECT. I know this is not a new problem, so I have read articles and
> source code(FileMon, MiniSpy) about this question before ask for help, but
> my question still not be solved.
> I want to get the path of the file in the pre-routine of read/write,
> FltGetFileNameInformation can not work at PagingIO, FILE_OBJECT will be
> modified during the filesystem operation and thus I can not reference
> filename by sha1(FILE_OBJECT).
> I wonder is there any method can get the path of the file in pre
> read/wirte routine? Any help will be appreciated!
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Do this is post-create instead, save to some (FO, name) table of yours.
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntfsd…
> As mentioned in title, I would like to know how to get the file path from FILE_OBJECT. I know this is not a new problem, so I have read articles and source code(FileMon, MiniSpy) about this question before ask for help, but my question still not be solved.
> I want to get the path of the file in the pre-routine of read/write, FltGetFileNameInformation can not work at PagingIO, FILE_OBJECT will be modified during the filesystem operation and thus I can not reference filename by sha1(FILE_OBJECT).
> I wonder is there any method can get the path of the file in pre read/wirte routine? Any help will be appreciated!
>
Thanks for your help!
But I don’t know where should I store the context of the file, is it like what Maxim said to create a (FO, name) table? But how to recognize a FO is the same FO we operated before? I tried to store sha1(FO) but found the new sha1(FO) is different from the previous sha1(FO).
> But I don’t know where should I store the context of the file
If you are going to write a file system filter you need to understand about
contexts. Lookup StreamContext, StreamHandleContext in the MSDN and then
read
http://fsfilters.blogspot.co.uk/2010/02/context-usage-in-minifilters.html
(and then store the name in the StreamContext if this is not NTFS or you
don’t care about links and the StreamHandleContext[*] if it is and you do).
Rod
[*] or and LCB, but that’s advanced usage which I’m not going into.
> But I don’t know where should I store the context of the file, is it like what Maxim said to create a (FO,
name) table?
Filter Manager provides stream contexts, which are usually even better then the hand-implemented table.
But how to recognize a FO is the same FO we operated before?
Stream handle context provides this guarantee.
BTW - to do any path comparisons, you need the paths in their canonical form.
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
Since you are using the filter manager, I would just stuff in into the stream context.
Note that the file can be renamed. If that affects what you are doing, and you need to correctly support hard links, you may need to track links instead of just streams.
- Danilo
Thanks for your response, it indeed help me a lot.
But I still confused about paging files, how can I get the file path in pagingIo? Because I learn that Microsoft file systems disable stream context support for paging files, so the stream context will have no effects in such condition, right?
Hi,
You should probably read in more depth the documentation about file systems
and contexts. You know you can allocate the context from non-paged pool
also if you really need to access stuff in the write path.
Anyway, try to avoid names after the Create path as much as possible, they
are irrelevant in a sense for the FS, plus they can change in so many
different ways even in the time you query the name itself. It is just messy
and you are asking for trouble by basing you design on names.
Do the assertion you need to do in the Create path based on the name, and
then mark that file in the context as a file that needs attention in the
write path.
The design you are choosing might have big performance issues in the wild.
Good luck,
Gabriel
On Tue, Aug 19, 2014 at 5:11 AM, wrote:
> Thanks for your response, it indeed help me a lot.
> But I still confused about paging files, how can I get the file path in
> pagingIo? Because I learn that Microsoft file systems disable stream
> context support for paging files, so the stream context will have no
> effects in such condition, right?
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
Bercea. G.
So don’t confuse paging IO with paging file IO. You can have paging IO on
pretty much any file. Paging files are special and in general you want to
avoid messing with them anyway (they’re safe to ignore for most filters…
not sure about your specific needs, you haven’t told us much about your
filter).
In terms of file name, FltMgr will cache the name anyway so it’s generally
not necessary to keep it in a context. FltMgr will also invalidate the name
when appropriate (like when a file is renamed - if you keep your own cache
of the name in a context then you need to handle those too). In general the
requirement to look at the file name in preRead/preWrite is indicative of
some unfortunate design choices (but not always). In most cases you want to
look at the name in postCreate (or possibly post Rename) and make whatever
decision you need to make there (and store the result of that decision in a
context; in fact for most designs you can even chose not have a context at
all for files you don’t care about and that’s a really good way to do
things). Like most things in life, there are exceptions, but perhaps you’re
lucky enough to fit in the standard case :).
Thanks,
Alex.
On Tue, Aug 19, 2014 at 2:13 AM, Gabriel Bercea wrote:
> Hi,
> You should probably read in more depth the documentation about file
> systems and contexts. You know you can allocate the context from non-paged
> pool also if you really need to access stuff in the write path.
> Anyway, try to avoid names after the Create path as much as possible, they
> are irrelevant in a sense for the FS, plus they can change in so many
> different ways even in the time you query the name itself. It is just messy
> and you are asking for trouble by basing you design on names.
> Do the assertion you need to do in the Create path based on the name, and
> then mark that file in the context as a file that needs attention in the
> write path.
> The design you are choosing might have big performance issues in the wild.
>
> Good luck,
> Gabriel
>
>
>
> On Tue, Aug 19, 2014 at 5:11 AM, wrote:
>
>> Thanks for your response, it indeed help me a lot.
>> But I still confused about paging files, how can I get the file path in
>> pagingIo? Because I learn that Microsoft file systems disable stream
>> context support for paging files, so the stream context will have no
>> effects in such condition, right?
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
>
>
> –
> Bercea. G.
> — NTFSD is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of debugging and file system
> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
> List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>