FltCreateFile returns STATUS_INVALID_DEVICE_REQUEST

Hi All,

I see different results calling FltCreateFile and ZwCreateFile routines in my mini-filter on Windows 2000. FltCreateFile (also as FltCreateFileEx) returns status code STATUS_INVALID_DEVICE_REQUEST when I am trying to create a file on disk C: using GUID based name of this volume. In the same point in code ZwCreateFile routine returns STATUS_SUCCESS and I get handle to the created file. The same parameters in both calls are equal. OBJECT_ATTRIBUTES structure is initialized as follows:

InitializeObjectAttributes( &ObjectAttributes,
&FileName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
NULL);

Where FileName is a unicode string representing volume GUID-based full path file name like ??\Volume{GUID}\MyFolder\MyFile.jrnl
FltCreateFile is called with the following parameters.

FltCreateFile( MyFilter,
NULL,
&FileHandle,
GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
NULL,
0,
IO_NO_PARAMETER_CHECKING);

In my mini-filter on Windows 2000 this routine returns status STATUS_INVALID_DEVICE_REQUEST. I do not get file handle but the file itself is created and I can open it in Notepad. So what could be a reason for this? Why does the FltCreateFile invocation fail?

Thanks in advance,
Roman

My guess is that your request is going to the wrong device. When you look at that device (I’d used the debugger to look at it) to what does it lead? If that doesn’t provide sufficient insight, walk into the function with the debugger and see what’s happening (as I recall, this uses IoCreateFileSpecifyDeviceObjectHint to perform its work.) Bottom line, you’ll need to figure out where the IRP is going and once you figure out where it’s going, you will probably be able to better figure out why it doesn’t work.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Hi Tony,

Thanks for the reply.
In debugger I have seen that IoCreateFileSpecifyDeviceObjectHint has successfully done its work. Also as I‘ve written in my email the file eventually appeared in the Windows explorer. But return status of the FltCreateFile routine was STATUS_INVALID_DEVICE_REQUEST. The reason for this status code was the fact that the FO_FILE_OBJECT_HAS_EXTENSION flag wasn’t set in the file objects Flags field.
I can’t understand why ZwCreateFile in the same point of code returns success and the FltCreateFile API in another mini-filter on the same system don’t fail.

Regards,
Roman

Hi Romalis,

Since IoCreateFileSpecifyDeviceObjectHint succeeded, the file is actually created by the file system because you have specified FILE_OPEN_IF create disposition. That’s why you can see the file and open it with notepad. The STATUS_INVALID_DEVICE_REQUEST must have been caused by the post processing after IoCreateFileSpecifyDeviceObjectHint and before FltCreateFile returned. I guess it is that FsRtlInsertPerFileObjectContext failed because the FO_FILE_OBJECT_HAS_EXTENSION flag was not set in the file object. Note that the file object extension is used to store the target I/O information. I guess in win2k the FO_FILE_OBJECT_HAS_EXTENSION flag indicates the existence of the file object extension while it seems no longer being used in vista and later.

Regards,

Hui
File System Filters
Microsoft Corp.

This posting is provided “AS IS” with no warranties, and confers no rights.

Hi Hui,

Thanks for reply. So, why the FO_FILE_OBJECT_HAS_EXTENSION flag could be not set in a file object? Does it mean that I can’t use FltCreateFile on Windows 2000?

Regards,
Roman