- Minifilter2 calls FltCreateFile
- FltMgr allocates targeting information (fltmgr calls it TargetedIoControl) and inserts it into an ECP structure and then it calls IoCreateFileEx with the ECP and a device hint that points to the device for Frame0.
- IoCreateFileEx goes through the usual steps in the OB manager, the OPEN_PACKET is initialized, and it eventually gets to IopParseDevice
- IoMgr in IopParseDevice allocates an IRP_MJ_CREATE , attaches the ECP and sends it directly to the hint device, Frame0.
- FltMgr get's the IRP_MJ_CREATE on the device for Frame0, looks for the targeting ECP and extracts the TargetedIoControl from it and then it analyzes it and figures out that the first minifilter that should see this request is Minifilter1.
- Minifilter1's preCreate callback get's called.
- the IRP_MJ_CREATE is processed further by the IO stack, file system and so on
- the IRP_MJ_CREATE completes to the IO manager
- IoCreateFileEx returns to FltMgr
- the original call to FltCreateFile returns control to Minifilter2
So these extensions are of different types, for internal use by various OS components. The interesting function here is nt!IopAllocateFoExtensionsOnCreate which initializes some extensions whenever a FILE_OBJECT is initialized. For example, if a DeviceHint was specified then some specific extension is allocated and then the IO manager will always use that extension on the FILE_OBJECT to figure out which device an IO request needs to be sent to. So IO manager's targeting information is associated with the FILE_OBJECT immediately upon creation. FltMgr takes a different approach. For one, it is not involved in FILE_OBJECT creation and so it doesn't know when the FILE_OBJECT is created. So the approach it takes is a bit more complex. Looking at the steps above associated with the picture above, in step 9 FltMgr now takes the TargetedIoControl structure that was associated with the IRP_MJ_CREATE and associates it with the FILE_OBJECT, before returning from FltCreateFile. In fact, the flow in FltCreateFile looks something like this:0: kd> dt nt!_FILE_OBJECT +0x000 Type : Int2B +0x002 Size : Int2B +0x004 DeviceObject : Ptr32 _DEVICE_OBJECT … +0x07c FileObjectExtension : Ptr32 Void 0: kd> x nt!*Extension* ... 828b1d09 nt!IopAllocateFileObjectExtension =
... 828a40e2 nt!IopGetFileObjectExtension = ... 828c8fe7 nt!IopSetTypeSpecificFoExtension = ... 82a686f0 nt!IopDeleteFileObjectExtension = 82aa3238 nt!IopSymlinkSetFoExtension = ... 82a6c1e7 nt!IopAllocateFoExtensionsOnCreate =
- Allocate TargetedIoControl
- Call IoCreateFileEx with the DeviceHint pointing to the current FltMgr device and the TargetedIoControl
- When IoCreateFileEx returns, if the create was successful, associate the TargetedIoControl with the FILE_OBJECT.
So as you can see, we have a function to add a TargetedIoControl as an ECP (undoubtedly for the IRP_MJ_CREATE case) and as a FILE_OBJECT context (after the IRP_MJ_CREATE is complete), as well as a function to get the target of an IO operation from the FILE_OBJECT context (fltmgr!FltpGetIoTargetFromFileObject). There doesn't seem to be a function that figures out the target from an ECP so that's probably only handled inline. The really important thing to note here is that this mechanism is different from the IO manager mechanism in that the FILE_OBJECT doesn't have FltMgr's targeting information that should be associated with it until after IoCreateFile returns. So for a fair bit of time, between the moment when the IRP_MJ_CREATE is completed by the file system (and when the FILE_OBJECT becomes initialized) and the moment when the IoCreateFileEx call returns to FltMgr, the FILE_OBJECT is initialized but it doesn't have any FltMgr targeting information (it does however have IO manager's targeting information). We'll discuss the implications of this particular approach (and the whole class of issues it introduces) in the next blog post, as well as a couple of various different approach FltMgr could have used.0: kd> x fltmgr!*target* 96050f68 fltmgr!FreeTargetedIoCtrl =
960394b6 fltmgr!FltpGetIoTargetFromFileObject = ... 96051114 fltmgr!TargetedIOCtrlGenerateECP = 9605132e fltmgr!TargetedIOCtrlAttachAsFoCtx =