OSRLogo
OSRLogoOSRLogoOSRLogo x OSR Custom Development Services
OSRLogo
x

Everything Windows Driver Development

x
x
x
GoToHomePage xLoginx
 
 

    Thu, 14 Mar 2019     118020 members

   Login
   Join


  
 
Contents
  Online Dump Analyzer
OSR Dev Blog
The NT Insider
The Basics
File Systems
Downloads
ListServer / Forum
  Express Links
  · The NT Insider Digital Edition - May-June 2016 Now Available!
  · Windows 8.1 Update: VS Express Now Supported
  · HCK Client install on Windows N versions
  · There's a WDFSTRING?
  · When CAN You Call WdfIoQueueP...ously

NTFS Does Not Support Query Operations on Stream File Objects
OSR Staff | Published: 05-Feb-04| Modified: 05-Feb-04

 The NTFS File System creates internally used "stream" file objects (called this because they are created using IoCreateStreamFileObject or one of its variants, not because they have anything to do with "file streams".)  These file objects are distinguished because they have the FO_STREAM_FILE bit set in the Flags field of the file object.

In Windows 2000 (and presumably earlier) versions of Windows, NTFS does not support file query operations (IRP_MJ_QUERY_INFORMATION) that request basic information on such file objects.  Unfortunately, rather than reject the request, NTFS attempts to use a null pointer in one of the data structures and causes the system to crash.

Kernel developers should be familiar with this limitation and not attempt to query this information from NTFS.

Related Articles
Tracking State and Context - Reference Counting for File System Filter Drivers
Windows Streams - An Introduction to File System Streams

User Comments
Rate this article and give us feedback. Do you find anything missing? Share your opinion with the community!
 Post Your Comment

 "Stream File Objects are not Streams"
There is a constant confusion with names here. An alternate data stream is NOT represented by a "stream file object". A stream file object is created by NTFS (or FAT or other file systems) for their own internal purposes. Since you never see an IRP_MJ_CREATE for the stream file object, this is not an issue for you. The point is, if you want to know what something is, query it in post-create processing and you'll be fine because FSD-created stream file objects are never seen in IRP_MJ_CREATE.

Rating:
28-Dec-06, Tony Mason

"hollyranch"
then if IRP_MJ_QUERY_INFORMATION can not be support on such a file object,how can we get the fileAttibute of the file, such as if it is a directory?

Rating:
18-Oct-06, hollyranch yu

Post Your Comments.
Print this article.
Email this article.
bottom nav links