File redirection & Directory Control

NTFSD
1

Hi All,

I am writing a minifilter in which I am redirecting *specific* files of a
directory to a different place. However, I want to keep the redirection
transparent to the user in such a way that the user still sees the
redirected file in the original directory.

To describe it better, I will give an example of FindFirstFile &
FindNextFile. Suppose I redirect all .txt files in directory
\Device\HarddiskVolume1\dir1 to \Device\HarddiskVolume2\dir2.

Let’s say a user calls FindFirstFile & FindNextFile for
\Device\HarddiskVolume1\dir1, I want to show the redirected files also as
part of this directory.

One way that I was thinking was to manipulate the IRP_MJ_DIRECTORY_CONTROL.
When I receive the callback for this, I will send 2 directory control
requests: one to Device\HarddiskVolume1\dir1 & the other to
\Device\HarddiskVolume2\dir2 and then merge the results and complete the
original IRP.

However, when I saw the documentation, I found that FltQueryDirectoryFile is
available only from Vista. I need to do this for 2000 & 2003.

The other way is to create a callback data using FltAllocateCallbackData &
then perform FltPerformAsynchronous/ FltPerformSynchronousIo.

I had some doubts:

  1. Does the limitation of creating our own callback data include this
    IRP also?

  2. Is this approach correct?

  3. Is there a better approach?

Thanks & Regards,

Ayush Gupta

2

It is working for us in XP, although we do not support 2k/2K3 but it should work.

In this scenario you probably have to perform buffer manipulation on your own. for example if you have 100 files in Dir1 & 100 files in Dir2 and let say that you can fill the buffer with 100 file names from Dir1 & 50 file Names from Dir2. Now 50 files are still their in Dir2. So you should manage somehow to get second Directory Control call without restart scan flag, Also your code should ensure that second time when you roll an IRP on Dir2, you should get files from 51 to 100.

3

Hi!

I suppose rolling an IRP is not a recommended way of doing things in minifilter, because then we will bypass other minifilters.
Are you talking about allocating our own callback data?

Regards,
Ayush Gupta

Bollywood, fun, friendship, sports and more. You name it, we have it.

4

Ayush Gupta wrote:

I remember this came up a few weeks ago. Here’s the link I posted last
time from the
archive.

http://www.osronline.com/showThread.cfm?link=73086

Matt

Hi All,

I am writing a minifilter in which I am redirecting **specific** files
of a directory to a different place. However, I want to keep the
redirection transparent to the user in such a way that the user still
sees the redirected file in the original directory.

To describe it better, I will give an example of FindFirstFile &
FindNextFile. Suppose I redirect all .txt files in directory
\Device\HarddiskVolume1\dir1 to \Device\HarddiskVolume2\dir2.

Let’s say a user calls FindFirstFile & FindNextFile for
\Device\HarddiskVolume1\dir1, I want to show the redirected files also
as part of this directory.

One way that I was thinking was to manipulate the
IRP_MJ_DIRECTORY_CONTROL. When I receive the callback for this, I will
send 2 directory control requests: one to Device\HarddiskVolume1\dir1
& the other to \Device\HarddiskVolume2\dir2 and then merge the results
and complete the original IRP.

However, when I saw the documentation, I found that
FltQueryDirectoryFile is available only from Vista. I need to do this
for 2000 & 2003.

The other way is to create a callback data using
FltAllocateCallbackData & then perform FltPerformAsynchronous/
FltPerformSynchronousIo.

I had some doubts:

  1. Does the limitation of creating our own callback data include this
    IRP also?

  2. Is this approach correct?

  3. Is there a better approach?

Thanks & Regards,

Ayush Gupta

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Hey thanks Matt…

Seems that the callback allocation & sending it will work…
Will try this. :slight_smile:

Regards,
Ayush Gupta

6

> In this scenario you probably have to perform buffer manipulation on your own. for example if you have 100 files in Dir1 & 100 files in Dir2 and let say that you can fill the buffer with 100 file names from Dir1 & 50 file Names from Dir2. Now 50 files are still their in Dir2. So you should manage somehow to get second Directory Control call without restart scan flag, Also your code should ensure that second time when you roll an IRP on Dir2, you should get files from 51 to 100.

It’s not needed to play with restart scan flag - lower driver (ntfs) will do that instead of you.

I suggest to return all your entries from Dir2 and then from Dir1.

During Dir2 enumeration (by rolling your own IRP from pre-IRP_MJ_DIRECTORY_CONTROL callback), see error codes:

  • STATUS_SUCCESS: it’s ok, but not all entries were returned yet (you’ll be called again for more files)
  • STATUS_NO_MORE_FILES: you’ve got some entries, but that’s all from Dir2
  • STATUS_NO_SUCH_FILE: no entry was found

When you’ll receive STATUS_NO_SUCH_FILE so just pass the I/O request down - ntfs will return file entries from Dir1 folder. If you receive STATUS_NO_MORE_FILES, complete the request, but next time (when IRP_MJ_DIRECTORY_CONTROL will be called) pass the I/O request down.

If you filter wildcard enumeration, ‘.’ and ‘…’ must be removed from the Dir1 results.
See SL_RESTART_SCAN and SL_RETURN_SINGLE_ENTRY flags. Your own IRP must inherit these flags from the caller’s IRP.

I use so called Directory Context to save the flags, filename mask and state in it. Note that if you want to enumerate files from a folder, firstly you have to open it and then close.

Petr Kurtin

7

>> Are you talking about allocating our own callback data?
Yes

>It’s not needed to play with restart scan flag - lower driver (ntfs) will do that instead of you.

Correct, I missed that its been set by FS Driver. what I meant to say is,

when an IRP on Dir1 returns STATUS_NO_MORE_FILES, you will Send an IRP for Dir2, not if you received X file names but have space to fit only X/2 in buffer than you have to ensure that next time you first fill the buffer with remaining X/2 file names because for next IRP on Dir2 lower filter will start picking files after X.

8

Be carefull for SL_RETURN_SINGLE_ENTRY flag. You must return STATUS_NO_SUCH_FILE instead STATUS_NO_MORE_FILES in such case. You will have to generate unique indices when you join two dirlists. Also short filenames can be ambiguous and you will have to map them back during IRP_MJ_CREATE.

Good luck
-bg

9

Please can any one help me in redirect the file C:\a.txt to C:\virtual\b.txt

10

return STATUS_REPARSE in IRP_MJ_CREATE
see this example:
http://kbalertz.com/319447/Implement-Reparsing-System-Filter-Driver.aspx

wrote in message news:xxxxx@ntfsd…
> Please can any one help me in redirect the file C:\a.txt to
> C:\virtual\b.txt
>