Windows Explorer and Reparse Point Files

NTFSD
1

I’ve implemented a user mode program and a minifilter that create a skeleton view of users files for a remote system. The user mode program creates a reparse tag for each file on the remote system. When a create request is detected, the minifilter asks the user mode program to download the file.

I’d like to prevent the Explorer File windows and File Open/Save dialogs from downloading the files. But, I also want to display the file thumbnails and file size.

I have also implemented a Shell Extension, IThumbnailProvider, that downloads a rendition of the file. This provides the file thumbnails.

But, I’m still seeing Explorer open my files for read access. I suspect this is for image/exif metadata. I’m thinking I need to implement another Shell Extension, but I haven’t been able to figure out which one. I’ve been looking at https://msdn.microsoft.com/en-us/library/windows/desktop/bb774328(v=vs.85).aspx.

Does someone know which extension or extensions I need to implement? Or, something I should handle in my minifilter? (I am ignoring FILE_READ_ATTRIBUTES | SYNCHRONIZE | DELETE | SPECIFIC_RIGHTS_ALL requests already.)

2

Per this page, https://msdn.microsoft.com/en-us/library/windows/desktop/ee719901(v=vs.85).aspx, looks like I also need to implement the IPropertyStore interface.

3

Implementing the IPropertyStore interface was not the solution. Using Process Monitor to look at the file access, it appears that thumbcache.dll is trying to read the files. Which I don’t understand as I have my own IThumbnailProvider installed.

4

That would assume your DLL is called first. Is it possible the system DLL is called first and then the call is routed to your custom provider?

Tony
OSR

5

Hi Tony,

That would match what I’m seeing. Using a combination of Process Monitor and DebugView:

  1. If I make my minifilter reject requests to open the file from Explorer, then my IThumbnailProvider is invoked.
  2. If I permit open requests from Explorer, I see thumbcache.dll in the call stack trying to open the file and my IThumbnailProvider is not called. It appears that the default thumbnail provider reads the downloaded file and creates the thumbnail.

Odd, now how to make Explorer use my handler first.

Thanks.

Nabeel

6

Update: if I use InitializeWithStream instead of InitializeWithFile, it appears my handler is invoked. But, that also triggers a download of the file.