EldoS | Feel safer!

Software components for data protection, secure storage and transfer

File size other than GetFileSize

Also by EldoS: MsgConnect
Cross-platform protocol-independent communication framework for building peer-to-peer and client-server applications and middleware components.
#23000
Posted: 12/30/2012 08:17:29
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

Hi - there are different apis to get file size information - FindFirstFile(), GetFileInformationByHandle() and GetFileSizeEX().

CbFlt only offers events for the GetFileSize function.

How to handle file size if the other api are called?

Thanks!
#23001
Posted: 12/30/2012 08:23:19
by Eugene Mayevski (EldoS Corp.)

You are looking from API point of view. Now try to look in the opposite direction. File size is reported by the filesystem in operations like directory enumeration, file information requests and file seek requests. Do you handle all such operations ?


Sincerely yours
Eugene Mayevski
#23002
Posted: 12/30/2012 08:25:34
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

Hi Eugene - yes, I have to, at the minimum for file information requests and file seek requests. What do you suggest?
#23003
Posted: 12/30/2012 08:27:40
by Eugene Mayevski (EldoS Corp.)

Do you filter and alter directory enumeration requests?


Sincerely yours
Eugene Mayevski
#23004
Posted: 12/30/2012 08:29:53
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

Maybe I need to, but I don't *have to* alter directory enumeration requests wrt file size.

On the other hand, when the user mode opens (createfile) and starts reading the file, I absolutely have to trap any file size requests.
#23005
Posted: 12/30/2012 08:45:58
by Eugene Mayevski (EldoS Corp.)

Nope, you have to do this.


Sincerely yours
Eugene Mayevski
#23006
Posted: 12/30/2012 08:51:24
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

That's not a problem, so how do I intercept these api??
#23007
Posted: 12/30/2012 09:56:28
by Vladimir Cherniga (EldoS Corp.)

Run ProcessMonitor from sysinternals.com, then enable advanced output and setup filter rules so that it could monitor the target files. Then you can see what operations performed by the system when you call FindFirstFile(), GetFileInformationByHandle(), GetFileSizeEX() and others. Hope it helps.
#23008
Posted: 12/30/2012 22:44:26
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

FYI for others who browse through this forum thread, the answers from Eldos are not clear. What I found...

If your app queries file size via GetFileInformationByHandle(), GetFileSizeEx(), GetFileSize() - these are all handled through the GetSizesCallback event.

If your app queries file size via FindFirstFile(), FindNextFile() - these are handled by the EnumerateDirectoryCallback event.

So your user mode app should handle both these events to correctly intercept all calls for file sizes.
#23011
Posted: 12/31/2012 00:01:59
by Eugene Mayevski (EldoS Corp.)

Hmm, I told you quite clearly that you have to handle directory enumeration requests. What part of my answers caused difficulties for you?


Sincerely yours
Eugene Mayevski
Also by EldoS: Solid File System
A virtual file system that offers a feature-rich storage for application documents and data with built-in compression and encryption.

Reply

Statistics

Topic viewed 3628 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!