Thanks for the answer
Best Regards,
Ethan
2017-03-28 20:24 GMT+02:00 Gabriel Bercea :
> Yep, reusing the original FO is OK.
> As far as oplocks by reusing the FO it is less likely you would break any.
> Make sure you do not update the byte offset as you do your I/O operations.
>
> Cheers,
> Gabriel
>
> On Mon, Mar 27, 2017 at 7:38 PM, wrote:
>
>> Hello all,
>>
>> I’d like to create a simple minifilter which makes a file copy for
>> further processing if it was written. I based the driver on msdn sample:
>> https://github.com/Microsoft/Windows-driver-samples/blob/mas
>> ter/filesys/miniFilter/scanner/filter/scanner.c
>>
>> The logic is simple:
>> 1. If file was succesfully created I’m allocating the context
>> (FLT_STREAMHANDLE_CONTEXT) in post IRP_MJ_CREATE
>> 2. Then in post IRP_MJ_WRITE I’m marking that file was written
>> 3. In pre IRP_MJ_CLEANUP I’m reading the file content using FILE_OBJECT I
>> was given in FLT_RELATED_OBJECTS structure
>>
>> Is it safe/fine to read the file using that FILE_OBJECT, in reference to
>> potential locks/oplocks? I think it is as I’m using the same file object in
>> the process context but I couldn’t find the confirmation.
>>
>> —
>> NTFSD is sponsored by OSR
>>
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at <
>> http://www.osronline.com/page.cfm?name=ListServer>
>>
>
>
>
> –
> Bercea. G.
> — NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis,
> WDF, Windows internals and software drivers! Details at To unsubscribe,
> visit the List Server section of OSR Online at</http:>