Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info:

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 5  
16 Dec 07 09:34
Romalis Vong
Join Date: 07 Oct 2005
Posts To This List: 4

Hi All, I see different results calling FltCreateFile and ZwCreateFile routines in my mini-filter on Windows 2000. FltCreateFile (also as FltCreateFileEx) returns status code STATUS_INVALID_DEVICE_REQUEST when I am trying to create a file on disk C: using GUID based name of this volume. In the same point in code ZwCreateFile routine returns STATUS_SUCCESS and I get handle to the created file. The same parameters in both calls are equal. OBJECT_ATTRIBUTES structure is initialized as follows: InitializeObjectAttributes( &ObjectAttributes, &FileName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL); Where FileName is a unicode string representing volume GUID-based full path file name like \??\Volume{GUID}\MyFolder\MyFile.jrnl FltCreateFile is called with the following parameters. FltCreateFile( MyFilter, NULL, &FileHandle, GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE, &ObjectAttributes, &IoStatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE, NULL, 0, IO_NO_PARAMETER_CHECKING); In my mini-filter on Windows 2000 this routine returns status STATUS_INVALID_DEVICE_REQUEST. I do not get file handle but the file itself is created and I can open it in Notepad. So what could be a reason for this? Why does the FltCreateFile invocation fail? Thanks in advance, Roman
  Message 2 of 5  
19 Dec 07 17:25
ntfsd member 8
Join Date:
Posts To This List: 2736

My guess is that your request is going to the wrong device. When you look at that device (I'd used the debugger to look at it) to what does it lead? If that doesn't provide sufficient insight, walk into the function with the debugger and see what's happening (as I recall, this uses IoCreateFileSpecifyDeviceObjectHint to perform its work.) Bottom line, you'll need to figure out where the IRP is going and once you figure out where it's going, you will probably be able to better figure out why it doesn't work. Tony Tony Mason Consulting Partner OSR Open Systems Resources, Inc.
  Message 3 of 5  
20 Dec 07 12:21
Romalis Vong
Join Date: 07 Oct 2005
Posts To This List: 4

Hi Tony, Thanks for the reply.=20 In debugger I have seen that IoCreateFileSpecifyDeviceObjectHint has succes= sfully done its work. Also as I=E2=80=98ve written in my email the file eve= ntually appeared in the Windows explorer. But return status of the FltCreat= eFile routine was STATUS_INVALID_DEVICE_REQUEST. The reason for this status= code was the fact that the FO_FILE_OBJECT_HAS_EXTENSION flag wasn=E2=80=99= t set in the file objects Flags field.=20 I can=E2=80=99t understand why ZwCreateFile in the same point of code retur= ns success and the FltCreateFile API in another mini-filter on the same sys= tem don=E2=80=99t fail. Regards,=20 Roman
  Message 4 of 5  
20 Dec 07 18:55
ntfsd member 36675
Join Date:
Posts To This List: 6

Hi Romalis, Since IoCreateFileSpecifyDeviceObjectHint succeeded, the file is actually created by the file system because you have specified FILE_OPEN_IF create disposition. That's why you can see the file and open it with notepad. The STATUS_INVALID_DEVICE_REQUEST must have been caused by the post processing after IoCreateFileSpecifyDeviceObjectHint and before FltCreateFile returned. I guess it is that FsRtlInsertPerFileObjectContext failed because the FO_FILE_OBJECT_HAS_EXTENSION flag was not set in the file object. Note that the file object extension is used to store the target I/O information. I guess in win2k the FO_FILE_OBJECT_HAS_EXTENSION flag indicates the existence of the file object extension while it seems no longer being used in vista and later. Regards, Hui File System Filters Microsoft Corp. This posting is provided "AS IS" with no warranties, and confers no rights.
  Message 5 of 5  
23 Dec 07 04:30
Romalis Vong
Join Date: 07 Oct 2005
Posts To This List: 4

Hi Hui, Thanks for reply. So, why the FO_FILE_OBJECT_HAS_EXTENSION flag could be no= t set in a file object? Does it mean that I can=E2=80=99t use FltCreateFile= on Windows 2000? Regards, Roman
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 20:12.

Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license