Shadow file objects questions

NTDEV
1

Hi,

I was reading docs about implementing shadow file objects to redirect file operations (instead of returning STATUS_REPARSE) in a minifilter.

But I have a silly questions I cannot figure out the answer on how to proceed.

Let’s say I’m at PreCreate operation in a minifilter and I want to redirect file A to file B so I call FltCreateFileEx and now what? Should I replace the original Irp’s FileObject? Or create a stream/file context and reroute all request to my internal fileobject?

Thanks,
Mauro.

2

You complete the original create request with success. Before completing the
request, you set your CCB (FsContext2) up to reference the file object you
created with FltCreateFile. You now have two file objects: the Upper file
object references *your* device object, and the Lower file object references
the FS device object. As I/O requests arrive at the Upper file object, you
swap the file object and send the request on its way.

There’s many a slip 'twixt the cup and the lip, but that’s the general idea.
Further discussion of this should really be on NTFSD.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntdev…

Hi,

I was reading docs about implementing shadow file objects to redirect file
operations (instead of returning STATUS_REPARSE) in a minifilter.

But I have a silly questions I cannot figure out the answer on how to
proceed.

Let’s say I’m at PreCreate operation in a minifilter and I want to redirect
file A to file B so I call FltCreateFileEx and now what? Should I replace
the original Irp’s FileObject? Or create a stream/file context and reroute
all request to my internal fileobject?

Thanks,
Mauro.

3

Thank you Scott for clarifying. I’ll open a new topic on NTFSD if I have more questions.

Kind regards.