What you could try, assuming you know that the files which you are going
to reparse are not actual reparse points, is to fail these opens with
the open_reparse_point bit set with STATUS_NOT_A_REPARSE_POINT.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: xxxxx@speedy.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 2/16/2017 6:55:56 AM
Subject: [ntfsd] STATUS_REPARSE and FILE_OPEN_REPARSE_POINT
>Hi!
>I am having a problem when writing a minifilter kernel driver that
>redirect files.
>The goal is to catch the IRP_MJ_CREATE pre operation and just do:
>
>Data->IoStatus.Information = IO_REPARSE;
>Data->IoStatus.Status = STATUS_REPARSE;
>Data->Iopb->TargetFileObject->RelatedFileObject = NULL;
>FltSetCallbackDataDirty(Data);
>return FLT_PREOP_COMPLETE;
>
>It works fine in most cases but there is one case that is not working
>as expected.
>When FILE_OPEN_REPARSE_POINT is set by an application sometimes the
>reparse does not apply and the ZwIOpenFile returns PATH NOT FOUND.
>
>My solution is a global solution that should work with any program.
>This issue typically happens when doing a file-save (e.g. in Notepad).
>There are some PreCreate events where I redirect the file to another
>location but then it comes this ZwOpenFile (in the stack trace
>kernelbase.dll calls DeleteFileW) having this FILE_OPEN_REPARSE_POINT
>and here instead of getting REPARSE in the Result tab (I am using
>Process Monitor) I get “PATH NOT FOUND” like if the reparse did not
>apply.
>
>The stranger is that it does not happen in most of the computers but in
>some of them and later on it “suddenly works fine” again…
>
>If I well understand, when a function uses FILE_OPEN_REPARSE_POINT then
>the reparse should not be applied right? So it’s like if my minifilter
>is not called and the original file is opened ignoring my replace,
>right? In this case, why does it work in some cases and not in others?
>
>Thanks
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>