none
Why can't DeleteFile after interrupt file operation of minifilter RRS feed

  • Question

  • Hello

    First : thanks to Mr.Donald for his advice about mini-filter 

    Second : my question is 

    Why can't my trusted user application delete file after interrupt file operation from mini-filter

    Sunday, January 27, 2013 3:49 PM

Answers

  • Either you need to do the operations completely in the mini-filter or you need to have something that identifies that a particular process ID is for your user service.  You basically would then check if the process ID is your service and not do anything to requests through the filter.  Since you already have communication with the user service you can have it pass its ID to the mini-filter.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Sunday, January 27, 2013 5:04 PM

All replies

  • What do you mean by "user application delete file after interrupt file operation from mini-filter"?  We need to know what the mini-filter is doing, what the application is going and what the error is?


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Sunday, January 27, 2013 3:57 PM
  • No errors

    My program reply message to mini-filter for cancel io operation (interrupt)

    my program need to delete this file after this cancel on user mode not on the driver

    And when i use DeleteFile(path) on user mode it's do nothing

    And when i use MoveFile(dpath,spath) to rename file it just copy file

     

    Sunday, January 27, 2013 4:27 PM
  • Well are you special casing your user space program?  If you are blocking open/create on the file you won't be able to delete the file since DeleteFile does an open.

    This is one those cases where you need to see exactly what the operations on the file are, and the results.  You may want to put the mini-spy driver above your filter and see what is happening.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Sunday, January 27, 2013 4:33 PM
  • Can i delete file or rename it on mini-filter in this way ??
    Sunday, January 27, 2013 4:38 PM
  • Either you need to do the operations completely in the mini-filter or you need to have something that identifies that a particular process ID is for your user service.  You basically would then check if the process ID is your service and not do anything to requests through the filter.  Since you already have communication with the user service you can have it pass its ID to the mini-filter.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Sunday, January 27, 2013 5:04 PM
  • i did it before my user app is trusted application on filter 

    But i don't know why i can't delete

    Sunday, January 27, 2013 5:07 PM