EldoS | Feel safer!

Software components for data protection, secure storage and transfer

File sizes callback and notification

Also by EldoS: Solid File System
A virtual file system that offers a feature-rich storage for application documents and data with built-in compression and encryption.
#18623
Posted: 01/05/2012 09:33:53
by Ivan Erceg (Basic support level)
Joined: 12/30/2011
Posts: 8

Quote
As i said before, EnumerateDirectoryCallback works wrong, when event handler not specified.


The event handler is always specified. It's never "not specified". I specify event handlers for all events (callbacks or notify) so I think you have other issues there as well.

Quote
The real fix will be applied to the forthcoming build of CallbackFilter.


Okay, I'll wait for that then. I need both GetFileSizes and EnumerateDirectory.
#18627
Posted: 01/05/2012 11:08:22
by Vladimir Cherniga (EldoS Corp.)

Quote
The event handler is always specified.

It wasn't clear to me from your previous messages. Anyway, did you return *FileFound = TRUE from the EnumerateDirectoryCallback event handler ?
#18628
Posted: 01/05/2012 19:23:00
by Ivan Erceg (Basic support level)
Joined: 12/30/2011
Posts: 8

Vladimir,

Quote
did you return *FileFound = TRUE from the EnumerateDirectoryCallback event handler ?


I have just tried that. It works: the filter finally triggers GetFileSizes handler. But get this: when I specify EnumerateDirectory flag then ReadCallback, WriteCallback and SetSizesCallback handlers are no longer triggered.

Here's how I'm configuring the filter:

filter->AddFilterCallbackRule(
"C:\\MyDir\\MyFile*.MyExt1",
SetSizesCallback|ReadCallback|WriteCallback|GetSizesCallback);

filter->AddFilterCallbackRule(
"C:\\MyDir\\MyFile*.MyExt2",
SetSizesCallback|ReadCallback|WriteCallback|GetSizesCallback);

filter->AddFilterCallbackRule(
"C:\\MyDir*",
EnumerateDirectoryCallback);

All three statements return TRUE (I check and raise exceptions if any doesn't). If I comment the 3rd statement then the filter triggers ReadCallback, WriteCallback and SetSizesCallback handlers. If I leave it then I don't get these - without any other change.

I have stopped setting handlers for post-Read/WriteFile as discussed before. All other handlers are set except GetSizesNotify as that crashes the app (as discussed before as well).

Thanks,
Ivan
#18630
Posted: 01/06/2012 03:26:53
by Vladimir Cherniga (EldoS Corp.)

It seems that your third rule is common for the first two rules. The rules with the same mask are summarized. The last applied rule checked first, it means that first two rules not checked. Try to change the order of rules or use another rules mask.
#18631
Posted: 01/06/2012 08:11:38
by Ivan Erceg (Basic support level)
Joined: 12/30/2011
Posts: 8

Thanks - changing the 3rd filter fixed the problem. I'm getting both GetFileSizesCallback and EnumerateDirectoryCallback events.

But it seems that this still isn't enough to intercept all queries to file sizes. Does CallbackFilter intercepts GetFileInformationByHandleEx with FileStandardInfo? I see that it does for FileBasicInfo but FileStandardInfo interception seems to be unsupported. Can you confirm this? If so, are there plans to add this? I have to be able to intercept *all* size queries toward files.

In documentation it is mentioned that CbFltEnumerateDirectoryEventN handler receives a FileId parameter which corresponds to the total number of clusters. But all I ever get there is 0 even for files that have non-zero sizes. Is the documentation correct? If so why name the parameter FileId instead of SizeInClusters or something such?

Thanks,
Ivan
#18636
Posted: 01/07/2012 08:37:21
by Vladimir Cherniga (EldoS Corp.)

Quote
Does CallbackFilter intercepts GetFileInformationByHandleEx with FileStandardInfo? I see that it does for FileBasicInfo but FileStandardInfo interception seems to be unsupported.

It supports next information class requests as a part of IRP_MJ_QUERY_INFORMATION
FileAllInformation
FileStandardInformation
FileNetworkOpenInformation

FileBasicInfo does not contain file size information, so it is not supported.

Quote
In documentation it is mentioned that CbFltEnumerateDirectoryEventN handler receives a FileId parameter which corresponds to the total number of clusters.


According to MSDN it is a:
Index of the file at which to begin the directory scan. Ignored if the SL_INDEX_SPECIFIED flag is not set. This parameter cannot be specified in any Win32 function or kernel-mode support routine. Currently it is used only by the NT virtual DOS machine (NTVDM), which exists only on 32-bit NT-based platforms. Note that the file index is undefined for file systems, such as NTFS, in which the position of a file within the parent directory is not fixed and can be changed at any time to maintain sort order.
Also by EldoS: Callback File System
Create virtual file systems and disks, expose and manage remote data as if they were files on the local disk.

Reply

Statistics

Topic viewed 5603 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!