EldoS | Feel safer!

Software components for data protection, secure storage and transfer

GetFileAttributesEx problem

Also by EldoS: CallbackProcess
A component to control process creation and termination in Windows and .NET applications.
#20549
Posted: 06/20/2012 04:19:24
by mike athan (Basic support level)
Joined: 06/01/2012
Posts: 6

Hi

We're decompressing files on demand and are using the filter mechanism to determine if a file is of size 0. If it is, we kick off the decompression of this file.

This process works correctly for calls that use GetFileSizeEx, which gets picked up by the GetSizes callback in our filter as expected.

However, we have found that calls that use GetFileAttributesEx are not being picked up by the GetSizes callback in our filter. This is even though the WIN32_FILE_ATTRIBUTE_DATA struct contains a file size field which is set to 0.
#20550
Posted: 06/20/2012 04:49:20
by Vladimir Cherniga (EldoS Corp.)

Hi,

Quote
However, we have found that calls that use GetFileAttributesEx are not being picked up by the GetSizes callback in our filter.

and how does Process Monitor log looks like in this case (with advanced output enabled) ?
#20551
Posted: 06/20/2012 04:50:54
by Eugene Mayevski (EldoS Corp.)

File information is often obtained via directory enumeration when file name is passed instead of the mask. Are you handling OnEnumerateDirectory as well?


Sincerely yours
Eugene Mayevski
#20552
Posted: 06/20/2012 05:59:46
by mike athan (Basic support level)
Joined: 06/01/2012
Posts: 6

Quote
Vladimir Cherniga wrote:
and how does Process Monitor log looks like in this case (with advanced output enabled)

Am including a piece of code we are using to query the file info.

Code
HANDLE file = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
        if (file == INVALID_HANDLE_VALUE)
        {
            return 1;
        }

        LARGE_INTEGER fileSz1;
        GetFileSizeEx(file, &fileSz1);

        WIN32_FILE_ATTRIBUTE_DATA attrs;
        GetFileAttributesEx(argv[1], GetFileExInfoStandard, &attrs);

        LARGE_INTEGER fileSz2;
        fileSz2.LowPart = attrs.nFileSizeLow;
        fileSz2.HighPart = attrs.nFileSizeHigh;

        printf("GetFileSize = %d, GetFileAttributes - size = %d", fileSz1.LowPart, fileSz2.LowPart);

        CloseHandle(file);


And in process monitor we have:

"11:50:14.1103862 AM","ConsoleApp.exe","6864","IRP_MJ_CREATE","C:\tmp\foo.wav","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"11:50:14.1106190 AM","ConsoleApp.exe","6864","IRP_MJ_QUERY_INFORMATION","C:\tmp\foo.wav","SUCCESS","Type: QueryStandardInformationFile, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1, DeletePending: False, Directory: False"
"11:50:14.1251548 AM","ConsoleApp.exe","6864","IRP_MJ_CREATE","C:\tmp\foo.wav","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"11:50:14.1252055 AM","ConsoleApp.exe","6864","FASTIO_QUERY_INFORMATION","C:\tmp\foo.wav","SUCCESS","Type: QueryNetworkOpenInformationFile, CreationTime: 20/06/2012 11:38:14 AM, LastAccessTime: 20/06/2012 11:38:14 AM, LastWriteTime: 20/06/2012 11:38:14 AM, ChangeTime: 20/06/2012 11:38:24 AM, AllocationSize: 01/01/1601 01:00:00 AM, EndOfFile: 01/01/1601 01:00:00 AM, FileAttributes: A"
"11:50:14.1252305 AM","ConsoleApp.exe","6864","IRP_MJ_CLEANUP","C:\tmp\foo.wav","SUCCESS",""
"11:50:14.1252670 AM","ConsoleApp.exe","6864","IRP_MJ_CLOSE","C:\tmp\foo.wav","SUCCESS",""
"11:50:14.1256821 AM","ConsoleApp.exe","6864","IRP_MJ_CLEANUP","C:\tmp\foo.wav","SUCCESS",""
"11:50:14.1257219 AM","ConsoleApp.exe","6864","IRP_MJ_CLOSE","C:\tmp\foo.wav","SUCCESS",""


We dont have a matching file size for the FASTIO_QUERY_INFORMATION.
#20553
Posted: 06/20/2012 06:04:36
by mike athan (Basic support level)
Joined: 06/01/2012
Posts: 6

Quote
Eugene Mayevski wrote:
File information is often obtained via directory enumeration when file name is passed instead of the mask. Are you handling OnEnumerateDirectory as well?


we are handling OnEnumerateDirectory callback but we dont see it called.
#20554
Posted: 06/20/2012 07:33:46
by Vladimir Cherniga (EldoS Corp.)

Try the attached driver. Additional FastIoQueryNetworkOpenInfo handling was added.


[ Download ]
#20556
Posted: 06/20/2012 08:27:13
by mike athan (Basic support level)
Joined: 06/01/2012
Posts: 6

Quote
Vladimir Cherniga wrote:
Try the attached driver. Additional FastIoQueryNetworkOpenInfo handling was added.


thanks for the fix. It worked. Can we have the driver with the FastIoQueryNetworkOpenInfo handling in 32 and 64 bit signed ?


thanks,

Mike
#20557
Posted: 06/20/2012 10:30:38
by Eugene Mayevski (EldoS Corp.)

The addition will be available in the next build.

Just a note: for registered users we sometimes make builds as soon as possible.


Sincerely yours
Eugene Mayevski
Also by EldoS: CallbackProcess
A component to control process creation and termination in Windows and .NET applications.

Reply

Statistics

Topic viewed 3605 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!