|
Hey everybody!
I'm looking for a way to get FsContext of a file in the NTFS file system.
All the code I've found about FsContext was always for drivers, which I am not looking for...
I am not trying to do that from the kernel (as a driver), but in user mode, as an application.
Does anyone know how to do that?
Thanks a lot in advance!
|
|
|
|
|
Hi,
Unfortunately the FILE_OBJECT structure associated with open file handles is inside the kernel address space therefore not directly accessible to usermode applications. There is no way to access this information from usermode without requesting it from a device driver. Perhaps you can describe what your trying to accomplish? There may be a better solution.
Best Wishes,
-David Delaune
|
|
|
|
|
I am trying to find a way to uniquely identify files over the system.
|
|
|
|
|
Now you really have me confused. What on earth gave you the idea that you needed the FSRTL_ADVANCED_FCB_HEADER[^] structure to identify unique files? Perhaps you meant unique open files?
The windows kernel keeps track of files which are open with an internel FILE_OBJECT[^] structure which is created when ZwCreateFile[^] is invoked.
Can you be more specific? Are you atte,pting enumerate unique files on the disk? Or are you attempting to enumerate all unique open files.
Best Wishes,
-David Delaune
|
|
|
|
|
I want to find all the sets of files in the system.
In other words, I want to be able to identify all the files that have the same "parent" or "root".
So, I turned up with FsContext2 because, from what I understood about the FsContext2 value, is that it is unique for each new file and it's decedents, so, when I create a new file it receives a new FsContext2 (in NTFS), and that number is unique.
When I create a copy of that file, the FsContext2 remains, so all the file's decedents have the same FsContext2 value.
Am I right? or so very far from being right?
|
|
|
|
|
Green Fuze wrote: Am I right? or so very far from being right?
Yes, you are partially correct but you seem to misunderstand these internel structures. These kernel structures only exist when the file is open as they are used for internel tracking of the file state and synchronizing of file access/locking. Files that are just sitting on your hard drive do not have a corresponding FILE_OBJECT and sub structures, they are stored on the hard drive in NTFS records.
Green Fuze wrote: I want to find all the sets of files in the system.
In other words, I want to be able to identify all the files that have the same "parent" or "root".
Are you actually saying that you want to find all files that have the same parent directory/folder?
Best Wishes,
-David Delaune
|
|
|
|
|
No, I want to find all the files that came from the same file.
So just to see that I understand correctly, to get the FsContext2, I must open the file and to do that in kernel mode because FILE_OBJECT is a kernel mode struct. Moreover, there is no way to get it in user-mode.
Am I correct ??? ( I hope not...  )
|
|
|
|
|
Green Fuze wrote: No, I want to find all the files that came from the same file.
Are you referring to NTFS Alternate Data Streams? Can you use standard software engineering terminology so I can figure out what the hell your trying to do, its driving me nuts.
Green Fuze wrote: So just to see that I understand correctly, to get the FsContext2, I must open the file and to do that in kernel mode because FILE_OBJECT is a kernel mode struct.
Each time a file or file-like object is opened the NT kernel creates an internal FILE_OBJECT structure for state tracking. It doesn't matter if the file was opened from usermode or kernelmode. These structures do not exist when the object is not being referenced/opened.
Green Fuze wrote: Moreover, there is no way to get it in user-mode.
Yes. It would be more correct to say that there are no documented methods of obtaining this structure from usermode without a driver.
Best Wishes,
-David Delaune
|
|
|
|
|
Hey,
sorry it took a while to respond, I had to get some sleep  .
I think the correct engineering terminology is "mapping" (which I am not sure that it is what its called).
I give an example:
I created a new file A.
I copies A to B, thus B was created.
B was copies to C.
Now, I want to know that C, B and A all came from the same file (A).
Now, I thought of using FsContext2 to do that because it has unique value for each of these groups...
Hope I clearer this time...
|
|
|
|
|
Green Fuze wrote:
I give an example:
I created a new file A.
I copies A to B, thus B was created.
B was copies to C.
Now, I want to know that C, B and A all came from the same file (A).
Thats a very interesting idea. I forgot to ask you what operating system you are developing for. A Microsoft technology similar to what you are describing is called Single-instance storage[^] and seems to be available on some flavors of Windows Server. It seems to work by adding a mapped section to the DataSection field of the SectionObjectPointers structure of File_Object.
One final question... What operating system are you trying to develop this for?
Best Wishes,
-David Delaune
|
|
|
|
|
AND Thanks!
|
|
|
|
|
I've used the following code to determine if TranslateMessage() has produced a WM_CHAR or not.
TranslateMessage( ... );
MSG msg;
while(PeekMessage(&msg, ... , PM_NOREMOVE)
{
if(msg.message == WM_CHAR) do_some_thing();
}
But the problem lies in this that PeekMessage() never returns zero and msg.message always is equal to WM_CHAR? 
Am I wrong? (of course I am  )
Thank you masters!
|
|
|
|
|
PM_NOREMOVE means that the message is left in the message queue, so the next time you call PeekMessage it's the same WM_CHAR you get, thus, infinite loop.
> The problem with computers is that they do what you tell them to do and not what you want them to do. <
|
|
|
|
|
I believe you need to call the DispatchMessage Function[^] to avoid the infinite loop in that particular piece of code. What are you trying to accomplish? If you are using MFC then perhaps you should instead look for WM_CHAR in CWnd::PreTranslateMessage[^] by calling the CWnd base class and then inspecting the results.
Best Wishes,
-David Delaune
|
|
|
|
|
my program works fine, untill i tried to add some feature.
i added a " CArray<CString> AA " to my class in the header file and the code no longer compiles, i did not refrence the variable yet and it gives me a function related error, here is the error:
1>D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxtempl.h(272) : error C2248: 'CObject::operator =' : cannot access private member declared in class 'CObject'
1> D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afx.h(554) : see declaration of 'CObject::operator ='
1> D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afx.h(524) : see declaration of 'CObject'
1> This diagnostic occurred in the compiler generated function 'CArray<TYPE> &CArray<TYPE>::operator =(const CArray<TYPE> & )'
1> with
1> [
1> TYPE=CString
1> ]
if i comment out the line " CArray<CString> AA " the code compiles with no problem, i am using CArray in other parts in the program but not as members, they are created inside functions and they work fine
why is the error and what can i do about it?? i want to read a list from a text file that a user saves
Ali Usam AlCherchefchi
modified on Saturday, December 6, 2008 1:16 PM
|
|
|
|
|
Might be due to the parameters for CArray constructor. Try this one.
CArray<CString,CString&> AA;
I hope that will fix the error. Well, if you just want to keep a list of string, you could use CStringArray as well.
Regards,
Jijo.
_____________________________________________________
http://weseetips.com[ ^] Visual C++ tips and tricks. Updated daily.
|
|
|
|
|
thanks for the reply but that did not help
i tried
CArray<CString,CString&> AA;
and
CStringArray AA;
same error in both cases, it is looking for the operator =, but i did not use the variable yet
Ali Usam AlCherchefchi
|
|
|
|
|
Could you please post the code snippet of the whole class? So that i can have a look at it.
Regards,
Jijo.
_____________________________________________________
http://weseetips.com[ ^] Visual C++ tips and tricks. Updated daily.
|
|
|
|
|
hiii
this is the header:
#pragma once
#include "ga_dna.h"
#include "afxtempl.h"
#define NoOf_cValues 20
#define NoOf_rValues 51
class GA_Individual
{
public:
GA_Individual(void);
public:
virtual ~GA_Individual(void);
public:
GA_DNA dna1;
.
.
.
.
.
GA_Individual(GA_DNA* pDNA);
static unsigned short c[NoOf_cValues];
static unsigned short r[NoOf_rValues];
public:
static bool initIndiv(void);
CArray <CString> opamp;
" and the same
};
the .cpp is like:
#include "StdAfx.h"
#include "GA_Individual.h"
#include "stdlib.h"
#include "windows.h"
#include <tchar.h>
#include <math.h>
unsigned short GA_Individual::c[NoOf_cValues];
unsigned short GA_Individual::r[NoOf_rValues];
GA_Individual::GA_Individual(void)
: Age(0)
{
CArray <CString> opamp(void);
}
GA_Individual::~GA_Individual(void)
{
}
GA_Individual::GA_Individual(GA_DNA* pDNA)
{
......
}
bool GA_Individual::initIndiv(void)
{
......
}
.
....... other function definitions here
.
i noticed a thing, if i make the array a ststic ( static CArray <cstring> opamp; ) member the code compiles, i can use it as a static with few axtra lines, but i am thinking what if using it as static was not an option, one should be able to add any type to the class, right, even if it did not have the operator '=' ???
Ali Usam AlCherchefchi
|
|
|
|
|
When you put it as a member in the header file, it gets instantiated as soon as the class is instantiated. You don't need to reference it to cause it to be called.
Therefore, you need to call the constructor in the header file, like so:
CArray<cstring,cstring> AA();
|
|
|
|
|
i tried but the same error, i also tried the initialization list but the same.
Ali Usam AlCherchefchi
|
|
|
|
|
"TYPE" needs to overload the '=' operator to work because when an item is added to the collection (CArray) a new instance of "TYPE" is created and the 'source' is copied into the new instance.
So for this to work you need to create a new class and overload the '=' operator to copy all data members.
BTW why don't you use CStringArray?
|
|
|
|
|
you mean to drive a class from "TYPE" and overload the '=' operator?? the CString already have one, or you mean to drive from the CArray and overload the '='??? i think this will work but not necessary, if the code will use the '=' operator each time i add an item this will be a big performance problem as the array may be long, 1000 or 10000, not sure yet.
now i think the problem is the class could not construct the array, but adding it in the constructor did not help!!!!
Ali Usam AlCherchefchi
|
|
|
|
|
No I don't mean that.
The error message you get is related to the '=' operator. Probably the class you declare the CArray in already has one? Or at least you are using '=' somewhere in your code for an instance of that class. You need to copy the AA member in the '=' operator definition yourself. E.g. AA.Copy( source.AA ); the CArray template does not have an '=' operator.
|
|
|
|
|
hiiii
thank you all for the help, now it is working really great.
but let me make things clear so if someone had the same problem can see where the error, cause the message you get from the compiler is not even close from the problem.
let say you have a class:
class BB
{
public
BB();
virtual ~BB();
CArray<cstring> AA; // or even a CAtringArray
BB &operator=(const BB &otherBB) // without this operator you cant add a CArray or CStringArray
}
Snorri wrote: Probably the class you declare the CArray in already has one? Or at least you are using '=' somewhere in your code for an instance of that class
when i read that i new the problem, it is in my class, see no class has no operator'=' (that if you used it in the program), so if you dont define one, the compiler will, and it will do it by calling each member's '=' operator, and if the operator is not existed then it stops and gives an error, evry one knows that but the error explanation dont even mentions it, and when i searched i didnot find an answer, so one can be drifted away. thanks all again
regards
Ali Usam AlCherchefchi
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
