Filtering the I/O requests sent by non-system applications in a file system filter driver.

Filtering the I/O requests sent by non-system applications in a file system filter driver.

Post by shaj » Thu, 01 May 2008 14:31:03


HI,
I'm a newbie in the world of drivers. I'm developing a file system
filter driver that needs to process all I/O requests sent in by user
mode applications eg; MS Word, Excel etc; I don't want to do any sort
of processing on IRPs generated on behalf of the Windows OS itself
( I'm not sure I'm using the correct words here :) ).

To put it simple, I want to distinguish between IRPs generated on
behalf of the OS processes and those generated on behalf of user mode
applications.

Could anybode tell me the easiest mechanism to achieve this?

Thanks in advance,
Shaji.
 
 
 

Filtering the I/O requests sent by non-system applications in a file system filter driver.

Post by David Crai » Thu, 01 May 2008 15:37:10

This is the wrong group. Try ntfsd on osronline.com.

 
 
 

Filtering the I/O requests sent by non-system applications in a file system filter driver.

Post by Eugene May » Thu, 01 May 2008 15:49:14

Hello!
You wrote on Tue, 29 Apr 2008 22:31:03 -0700 (PDT):

s> To put it simple, I want to distinguish between IRPs generated on
s> behalf of the OS processes and those generated on behalf of user mode
s> applications.

There are cases when the OS issues requests on behalf of the application (or
it's needs). Examples: if the application accesses the file via MMF, or when
cache manager accesses the file (I am not 100% sure about the latter case).

With best regards,
Eugene Mayevski
http://www.yqcomputer.com/
 
 
 

Filtering the I/O requests sent by non-system applications in a file system filter driver.

Post by shaj » Thu, 01 May 2008 18:14:15

Hi Eugene Mayevski,


Thanks a lot for that reply. I know that IoGetRequestorProcess will
give me the process which requested the I/O. If the application uses
MMF to access the file, will this function return the system process
that issues MMF request?
Shaji.
 
 
 

Filtering the I/O requests sent by non-system applications in a file system filter driver.

Post by Maxim S. S » Fri, 02 May 2008 18:21:17


Impossible. The kernel does not know the difference between, say,
OS-provided svchost.exe and the user-installed winword.exe

Also note that some work initiated by apps like Word will be executed in
System process context - cache flushes and read-aheads.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
XXXX@XXXXX.COM
http://www.yqcomputer.com/