Hi everyone:
I’m developing a file system filter driver based on sfilter.I’m
working on Windows 2000 sp1 system with 2 volumes in NTFS and one in FAT32.
In sfilter if the filter captures a mount IRP,it will register a
completion roution and then call IoCallDriver() to complete the IRP.But i
find ,in my system, the returned value of IoCallDriver() will be
STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted, while it will be
STATUS_SUCCESS if a FAT32 or a FAT volume is mounted.I’m puzzled on it.I
hope i can get some help from you.Thank you very much!
Best Regards!
Jim
Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
Does your system bott from FAT32 volume?
–htfv
“zhong du” wrote in message news:xxxxx@ntfsd…
> Hi everyone:
> I’m developing a file system filter driver based on sfilter.I’m
> working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
> FAT32.
> In sfilter if the filter captures a mount IRP,it will register a
> completion roution and then call IoCallDriver() to complete the IRP.But i
> find ,in my system, the returned value of IoCallDriver() will be
> STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted, while it will be
> STATUS_SUCCESS if a FAT32 or a FAT volume is mounted.I’m puzzled on it.I
> hope i can get some help from you.Thank you very much!
> Best Regards!
>
> Jim
>
> _________________________________________________________________
> ??? MSN Explorer: http://explorer.msn.com/lccn
>
My system boot from NTFS volume.
Jim
From: “Alexey Logachyov”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: Re:[ntfsd] Question about sfilter and NTFS
>Date: Fri, 20 Feb 2004 01:08:10 +0200
>
>Does your system bott from FAT32 volume?
>
>–htfv
>
>
>“zhong du” wrote in message news:xxxxx@ntfsd…
> > Hi everyone:
> > I’m developing a file system filter driver based on sfilter.I’m
> > working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
> > FAT32.
> > In sfilter if the filter captures a mount IRP,it will register a
> > completion roution and then call IoCallDriver() to complete the IRP.But
i
> > find ,in my system, the returned value of IoCallDriver() will be
> > STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted, while it will
be
> > STATUS_SUCCESS if a FAT32 or a FAT volume is mounted.I’m puzzled on
it.I
> > hope i can get some help from you.Thank you very much!
> > Best Regards!
> >
> > Jim
> >
> >
> > ??? MSN Explorer: http://explorer.msn.com/lccn
> >
>
>
>
>—
>Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger: http://messenger.msn.com/cn
The OS tries to mount all filesystems to all volumes.
If the on-disk data is FAT, then you will have STATUS_UNRECOGNIZED_VOLUME
from NTFS mount attempt and STATUS_SUCCESS from FAT mount attempt.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “zhong du”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, February 19, 2004 7:20 PM
Subject: [ntfsd] Question about sfilter and NTFS
> Hi everyone:
> I’m developing a file system filter driver based on sfilter.I’m
> working on Windows 2000 sp1 system with 2 volumes in NTFS and one in FAT32.
> In sfilter if the filter captures a mount IRP,it will register a
> completion roution and then call IoCallDriver() to complete the IRP.But i
> find ,in my system, the returned value of IoCallDriver() will be
> STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted, while it will be
> STATUS_SUCCESS if a FAT32 or a FAT volume is mounted.I’m puzzled on it.I
> hope i can get some help from you.Thank you very much!
> Best Regards!
>
> Jim
>
> _________________________________________________________________
> ??? MSN Explorer: http://explorer.msn.com/lccn
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks.
But I received only STATUS_UNRECOGNIZED_VOLUME when I try to mount a
NTFS volume.Everything is ok if a FAT32 or FAT volume is mounted.
From: “Maxim S. Shatskih”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: Re: [ntfsd] Question about sfilter and NTFS
>Date: Fri, 20 Feb 2004 17:43:09 +0300
>
> The OS tries to mount all filesystems to all volumes.
>
> If the on-disk data is FAT, then you will have
STATUS_UNRECOGNIZED_VOLUME
>from NTFS mount attempt and STATUS_SUCCESS from FAT mount attempt.
>
>Maxim Shatskih, Windows DDK MVP
>StorageCraft Corporation
>xxxxx@storagecraft.com
>http://www.storagecraft.com
>
>
>----- Original Message -----
>From: “zhong du”
>To: “Windows File Systems Devs Interest List”
>Sent: Thursday, February 19, 2004 7:20 PM
>Subject: [ntfsd] Question about sfilter and NTFS
>
>
> > Hi everyone:
> > I’m developing a file system filter driver based on sfilter.I’m
> > working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
FAT32.
> > In sfilter if the filter captures a mount IRP,it will register a
> > completion roution and then call IoCallDriver() to complete the IRP.But
i
> > find ,in my system, the returned value of IoCallDriver() will be
> > STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted, while it will
be
> > STATUS_SUCCESS if a FAT32 or a FAT volume is mounted.I’m puzzled on
it.I
> > hope i can get some help from you.Thank you very much!
> > Best Regards!
> >
> > Jim
> >
> >
> > ??? MSN Explorer: http://explorer.msn.com/lccn
> >
> >
> > —
> > Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>—
>Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
Hi all:
I have been reading SFilter’s code all day.I think maybe I have found
where the problem is,but i still don’t know how to resolve it.
In SFilte’s DriverEntry(),the driver calls
IoRegisterFsRegistrationChange() to ask the I/O Manager to inform it
whenever a FSD registers itself.Then the driver will be able to creat a
device object of itself and attach it to the FSD when a FSD registers
itself.My system boots from a NTFS volume ,so the NTFS driver registers
itself at boot time,while my driver is loaded after the system has been
booted(in registry,the value of “start” is 1).
For that reason my filter cannot attach itself to the NTFS driver and it is
not able to filter IRPs directed to NTFS driver.
I try to load my filter at boot time(modify the registry set the value
of “start” 1),but it result in system halting.I hope I can get some help
here.Thanks very much.
Best Regards.
Jim
From: “zhong du”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: [ntfsd] Question about sfilter and NTFS
>Date: Thu, 19 Feb 2004 16:20:11 +0000
>
>Hi everyone:
> I’m developing a file system filter driver based on sfilter.I’m
>working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
>FAT32.
> In sfilter if the filter captures a mount IRP,it will register
>a completion roution and then call IoCallDriver() to complete the
>IRP.But i find ,in my system, the returned value of IoCallDriver()
>will be STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted,
>while it will be STATUS_SUCCESS if a FAT32 or a FAT volume is
>mounted.I’m puzzled on it.I hope i can get some help from you.Thank
>you very much!
> Best Regards!
>
> Jim
>
>
>Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to
>xxxxx@lists.osr.com
ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger: http://messenger.msn.com/cn
Most probable cause: DbgBreakPoint() within the driver. It’s something most
people overlook when first testing SFilter - no debugger attached. I think SoftICE
will not catch DbgBreakPoint this early!
zhong du wrote:
Hi all:
I have been reading SFilter’s code all day.I think maybe I have found
where the problem is,but i still don’t know how to resolve it.
In SFilte’s DriverEntry(),the driver calls
IoRegisterFsRegistrationChange() to ask the I/O Manager to inform it
whenever a FSD registers itself.Then the driver will be able to creat a
device object of itself and attach it to the FSD when a FSD registers
itself.My system boots from a NTFS volume ,so the NTFS driver registers
itself at boot time,while my driver is loaded after the system has been
booted(in registry,the value of “start” is 1).
For that reason my filter cannot attach itself to the NTFS driver and it is
not able to filter IRPs directed to NTFS driver.
I try to load my filter at boot time(modify the registry set the value
of “start” 1),but it result in system halting.I hope I can get some help
here.Thanks very much.
Best Regards.
Jim
>From: “zhong du”
> >Reply-To: “Windows File Systems Devs Interest List”
> >To: “Windows File Systems Devs Interest List”
> >Subject: [ntfsd] Question about sfilter and NTFS
> >Date: Thu, 19 Feb 2004 16:20:11 +0000
> >
> >Hi everyone:
> > I’m developing a file system filter driver based on sfilter.I’m
> >working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
> >FAT32.
> > In sfilter if the filter captures a mount IRP,it will register
> >a completion roution and then call IoCallDriver() to complete the
> >IRP.But i find ,in my system, the returned value of IoCallDriver()
> >will be STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted,
> >while it will be STATUS_SUCCESS if a FAT32 or a FAT volume is
> >mounted.I’m puzzled on it.I hope i can get some help from you.Thank
> >you very much!
> > Best Regards!
> >
> > Jim
> >
> >
> >Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to
> >xxxxx@lists.osr.com
>
>
> ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger: http://messenger.msn.com/cn
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
Hi Dejan:
I tried to remove all debug sentences in SFilter and build it in free
version.But it still can’t run at boot time(on WINDOWS 2000 SP4).
Since it is not available in this way,I have another ideal that I’ll
register NTFS to system myself. Maybe my filter will get informed and be
able to attach itself to NTFS. How do you think about this plan? If it is
possible could u tell me how to get the pointer to NTFS driver object?
Thanks.
Jim
From: Dejan Maksimovic
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: Re: [ntfsd] Question about sfilter and NTFS
>Date: Sun, 22 Feb 2004 00:46:23 +0100
>
>
> Most probable cause: DbgBreakPoint() within the driver. It’s
something most
>people overlook when first testing SFilter - no debugger attached. I think
SoftICE
>will not catch DbgBreakPoint this early!
>
>zhong du wrote:
>
> > Hi all:
> > I have been reading SFilter’s code all day.I think maybe I have
found
> > where the problem is,but i still don’t know how to resolve it.
> > In SFilte’s DriverEntry(),the driver calls
> > IoRegisterFsRegistrationChange() to ask the I/O Manager to inform it
> > whenever a FSD registers itself.Then the driver will be able to creat a
> > device object of itself and attach it to the FSD when a FSD registers
> > itself.My system boots from a NTFS volume ,so the NTFS driver registers
> > itself at boot time,while my driver is loaded after the system has been
> > booted(in registry,the value of “start” is 1).
> > For that reason my filter cannot attach itself to the NTFS driver and
it is
> > not able to filter IRPs directed to NTFS driver.
> > I try to load my filter at boot time(modify the registry set the
value
> > of “start” 1),but it result in system halting.I hope I can get some
help
> > here.Thanks very much.
> >
> > Best Regards.
> > Jim
> >
> > >From: “zhong du”
> > >Reply-To: “Windows File Systems Devs Interest List”
> > >To: “Windows File Systems Devs Interest List”
> > >Subject: [ntfsd] Question about sfilter and NTFS
> > >Date: Thu, 19 Feb 2004 16:20:11 +0000
> > >
> > >Hi everyone:
> > > I’m developing a file system filter driver based on sfilter.I’m
> > >working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
> > >FAT32.
> > > In sfilter if the filter captures a mount IRP,it will register
> > >a completion roution and then call IoCallDriver() to complete the
> > >IRP.But i find ,in my system, the returned value of IoCallDriver()
> > >will be STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted,
> > >while it will be STATUS_SUCCESS if a FAT32 or a FAT volume is
> > >mounted.I’m puzzled on it.I hope i can get some help from you.Thank
> > >you very much!
> > > Best Regards!
> > >
> > > Jim
> > >
> > >
> > >Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
> > >
> > >
> > >—
> > >Questions? First check the IFS FAQ at
> > >https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> > >To unsubscribe send a blank email to
> > >xxxxx@lists.osr.com
> >
> >
> > ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger:
http://messenger.msn.com/cn
> >
> > —
> > Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>–
>Kind regards, Dejan M. MVP for DDK
>http://www.alfasp.com E-mail: xxxxx@alfasp.com
>Alfa Transparent File Encryptor - Transparent file encryption services.
>Alfa File Protector - File protection and hiding library for Win32
developers.
>Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>
>—
>Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
_________________________________________________________________
ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com
If you have Soft-ICE, it can help you. Use the
SIWSYM.sys driver (look for the SIWSYM.txt
in the Soft-ICE installation directory, there
are instructions how to use it.
Then you will be able to debug DriverEntry,
even if it is in the driver that loads itself
at boot time.
L.
----- Original Message -----
From: “zhong du”
To: “Windows File Systems Devs Interest List”
Sent: Sunday, February 22, 2004 4:49 PM
Subject: Re: [ntfsd] Question about sfilter and NTFS
> Hi Dejan:
> I tried to remove all debug sentences in SFilter and build it in free
> version.But it still can’t run at boot time(on WINDOWS 2000 SP4).
> Since it is not available in this way,I have another ideal that I’ll
> register NTFS to system myself. Maybe my filter will get informed and be
> able to attach itself to NTFS. How do you think about this plan? If it is
> possible could u tell me how to get the pointer to NTFS driver object?
> Thanks.
> Jim
>
> >From: Dejan Maksimovic
> >Reply-To: “Windows File Systems Devs Interest List”
> >To: “Windows File Systems Devs Interest List”
> >Subject: Re: [ntfsd] Question about sfilter and NTFS
> >Date: Sun, 22 Feb 2004 00:46:23 +0100
> >
> >
> > Most probable cause: DbgBreakPoint() within the driver. It’s
> something most
> >people overlook when first testing SFilter - no debugger attached. I
think
> SoftICE
> >will not catch DbgBreakPoint this early!
> >
> >zhong du wrote:
> >
> > > Hi all:
> > > I have been reading SFilter’s code all day.I think maybe I have
> found
> > > where the problem is,but i still don’t know how to resolve it.
> > > In SFilte’s DriverEntry(),the driver calls
> > > IoRegisterFsRegistrationChange() to ask the I/O Manager to inform it
> > > whenever a FSD registers itself.Then the driver will be able to creat
a
> > > device object of itself and attach it to the FSD when a FSD registers
> > > itself.My system boots from a NTFS volume ,so the NTFS driver
registers
> > > itself at boot time,while my driver is loaded after the system has
been
> > > booted(in registry,the value of “start” is 1).
> > > For that reason my filter cannot attach itself to the NTFS driver and
> it is
> > > not able to filter IRPs directed to NTFS driver.
> > > I try to load my filter at boot time(modify the registry set the
> value
> > > of “start” 1),but it result in system halting.I hope I can get some
> help
> > > here.Thanks very much.
> > >
> > > Best Regards.
> > > Jim
> > >
> > > >From: “zhong du”
> > > >Reply-To: “Windows File Systems Devs Interest List”
>
> > > >To: “Windows File Systems Devs Interest List”
> > > >Subject: [ntfsd] Question about sfilter and NTFS
> > > >Date: Thu, 19 Feb 2004 16:20:11 +0000
> > > >
> > > >Hi everyone:
> > > > I’m developing a file system filter driver based on sfilter.I’m
> > > >working on Windows 2000 sp1 system with 2 volumes in NTFS and one in
> > > >FAT32.
> > > > In sfilter if the filter captures a mount IRP,it will register
> > > >a completion roution and then call IoCallDriver() to complete the
> > > >IRP.But i find ,in my system, the returned value of IoCallDriver()
> > > >will be STATUS_UNRECOGNIZED_VOLUME if an NTFS volume is mounted,
> > > >while it will be STATUS_SUCCESS if a FAT32 or a FAT volume is
> > > >mounted.I’m puzzled on it.I hope i can get some help from you.Thank
> > > >you very much!
> > > > Best Regards!
> > > >
> > > > Jim
> > > >
> > > >
> > > >Ãâ·ÑÏÂÔØ MSN Explorer: http://explorer.msn.com/lccn
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at
> > > >https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> > > >To unsubscribe send a blank email to
> > > >xxxxx@lists.osr.com
> > >
> > >
> > > ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger:
> http://messenger.msn.com/cn
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >–
> >Kind regards, Dejan M. MVP for DDK
> >http://www.alfasp.com E-mail: xxxxx@alfasp.com
> >Alfa Transparent File Encryptor - Transparent file encryption services.
> >Alfa File Protector - File protection and hiding library for Win32
> developers.
> >Alfa File Monitor - File monitoring library for Win32 developers.
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> _________________________________________________________________
> ÏíÓÃÊÀ½çÉÏ×î´óµÄµç×ÓÓʼþϵͳ¡ª MSN Hotmail¡£ http://www.hotmail.com
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@volny.cz
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>