Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 3  
18 May 17 13:39
Ethan Kevin Ward
xxxxxx@gmail.com
Join Date: 27 Mar 2017
Posts To This List: 4
FltCreateFile and IO_STATUS_BLOCK

Hello, In IRP_MJ_CLEANUP pre callback I need to open given file for further processing. Based on what I learnt and saw in msdn samples I should use FltCreateFile. I encountered problems with oplocks on shared drives as the FltCreateFile (I'm using the FILE_COMPLETE_IF_OPLOCKED option) returned STATUS_SUCCESS instead of STATUS_OPLOCK_BREAK_IN_PROGRESS. When I hit that scenerio in windbg I saw that returned status is STATUS_SUCCESS but in IO_STATUS_BLOCK there's desired STATUS_OPLOCK_BREAK_IN_PROGRESS status. I'd like to ask you if I should use this function in this way then: ... IO_STATUS_BLOCK iosb = {0} NTSTATUS ntStatus = FltCreateFile(... , iosb, ... ); if ( NT_SUCESS(ntStatus) ) ntstatus = iosb.Status; ... I'd be very grateful for any help or suggestions or if you need more information (like parameters I'm using). This is a bit confusing for me because till I encountered that issue (windows 2k3 x86) I saw everyone use the return from the function itself not the iosb. Kind Regards, Kevin
  Message 2 of 3  
18 May 17 15:02
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 903
List Moderator
FltCreateFile and IO_STATUS_BLOCK

That's pretty weird. Are there any filters layered beneath you? You might want to turn Driver Verifier on for your driver + FltMgr.sys + any file system or filters below you. Feels like a bug. -scott OSR @OSRDrivers wrote in message news:102548@ntfsd... Hello, In IRP_MJ_CLEANUP pre callback I need to open given file for further processing. Based on what I learnt and saw in msdn samples I should use FltCreateFile. I encountered problems with oplocks on shared drives as the FltCreateFile (I'm using the FILE_COMPLETE_IF_OPLOCKED option) returned STATUS_SUCCESS instead of STATUS_OPLOCK_BREAK_IN_PROGRESS. When I hit that scenerio in windbg I saw that returned status is STATUS_SUCCESS but in IO_STATUS_BLOCK there's desired STATUS_OPLOCK_BREAK_IN_PROGRESS status. I'd like to ask you if I should use this function in this way then: ... IO_STATUS_BLOCK iosb = {0} NTSTATUS ntStatus = FltCreateFile(... , iosb, ... ); if ( NT_SUCESS(ntStatus) ) ntstatus = iosb.Status; ... I'd be very grateful for any help or suggestions or if you need more information (like parameters I'm using). This is a bit confusing for me because till I encountered that issue (windows 2k3 x86) I saw everyone use the return from the function itself not the iosb. Kind Regards, Kevin
  Message 3 of 3  
19 May 17 12:18
Ethan Kevin Ward
xxxxxx@gmail.com
Join Date: 27 Mar 2017
Posts To This List: 4
FltCreateFile and IO_STATUS_BLOCK

Thank you Scott, now I know that it shouldn't work this way. So I made a small research and opened fltMgr.sys (5.2.3790.3959) under disassembler and here's what I found: FltCreateFile->FltCreateFileEx->IoCreateFileSpecifyDeviceObjectHint The returned value from IoCreateFileSpecifyDeviceObjectHint is in iosb but it's not returned from FltCreateFileEx, instead FltCreateFileEx will return status returned from next functions for which it's a "wrapper" (If I can call it this way). I checked also fltMgr.sys (6.1.7600.16385) from windows 7: FltCreateFile->FltCreateFileEx2->IoCreateFileEx FltCreateFileEx2 saves IoCreateFileEx status in an additional variable and if FltCreateFileEx2's other calls are success it will return what is really interesting - the IoCreateFileEx result. So it will work fine there Is it a bug? Should I then firstly check the returned status from FltCreateFile and if it's a success, treat iosb.Status as a status of file opening?
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 07:45.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license