C / C++ / MFC

6-Dec-08 11:54

Hey everybody!

I'm looking for a way to get FsContext of a file in the NTFS file system.

All the code I've found about FsContext was always for drivers, which I am not looking for...
I am not trying to do that from the kernel (as a driver), but in user mode, as an application.

Does anyone know how to do that?

Thanks a lot in advance!

Randor 6-Dec-08 14:57

Randor

6-Dec-08 14:57

Hi,

Unfortunately the FILE_OBJECT structure associated with open file handles is inside the kernel address space therefore not directly accessible to usermode applications. There is no way to access this information from usermode without requesting it from a device driver. Perhaps you can describe what your trying to accomplish? There may be a better solution.

Best Wishes,
-David Delaune

Green Fuze6-Dec-08 14:59

6-Dec-08 14:59

I am trying to find a way to uniquely identify files over the system.

Randor 6-Dec-08 15:42

Randor

6-Dec-08 15:42

Now you really have me confused. What on earth gave you the idea that you needed the FSRTL_ADVANCED_FCB_HEADER[^] structure to identify unique files? Perhaps you meant unique open files?

The windows kernel keeps track of files which are open with an internel FILE_OBJECT[^] structure which is created when ZwCreateFile[^] is invoked.

Can you be more specific? Are you atte,pting enumerate unique files on the disk? Or are you attempting to enumerate all unique open files.

Best Wishes,
-David Delaune

Green Fuze6-Dec-08 15:52

6-Dec-08 15:52

I want to find all the sets of files in the system.
In other words, I want to be able to identify all the files that have the same "parent" or "root".

So, I turned up with FsContext2 because, from what I understood about the FsContext2 value, is that it is unique for each new file and it's decedents, so, when I create a new file it receives a new FsContext2 (in NTFS), and that number is unique.
When I create a copy of that file, the FsContext2 remains, so all the file's decedents have the same FsContext2 value.

Am I right? or so very far from being right?

Randor 6-Dec-08 16:24

Randor

6-Dec-08 16:24

Green Fuze wrote:
Am I right? or so very far from being right?

Yes, you are partially correct but you seem to misunderstand these internel structures. These kernel structures only exist when the file is open as they are used for internel tracking of the file state and synchronizing of file access/locking. Files that are just sitting on your hard drive do not have a corresponding FILE_OBJECT and sub structures, they are stored on the hard drive in NTFS records.

Green Fuze wrote:
I want to find all the sets of files in the system.
In other words, I want to be able to identify all the files that have the same "parent" or "root".

Are you actually saying that you want to find all files that have the same parent directory/folder?

Best Wishes,
-David Delaune

Green Fuze6-Dec-08 16:33

6-Dec-08 16:33

No, I want to find all the files that came from the same file.

So just to see that I understand correctly, to get the FsContext2, I must open the file and to do that in kernel mode because FILE_OBJECT is a kernel mode struct. Moreover, there is no way to get it in user-mode.

Am I correct ??? ( I hope not... Sigh | :sigh:

)

Randor 6-Dec-08 17:04

Randor

6-Dec-08 17:04

Green Fuze wrote:
No, I want to find all the files that came from the same file.

Are you referring to NTFS Alternate Data Streams? Can you use standard software engineering terminology so I can figure out what the hell your trying to do, its driving me nuts.

Green Fuze wrote:
So just to see that I understand correctly, to get the FsContext2, I must open the file and to do that in kernel mode because FILE_OBJECT is a kernel mode struct.

Each time a file or file-like object is opened the NT kernel creates an internal FILE_OBJECT structure for state tracking. It doesn't matter if the file was opened from usermode or kernelmode. These structures do not exist when the object is not being referenced/opened.

Green Fuze wrote:
Moreover, there is no way to get it in user-mode.

Yes. It would be more correct to say that there are no documented methods of obtaining this structure from usermode without a driver.

Best Wishes,
-David Delaune

Green Fuze6-Dec-08 22:54

6-Dec-08 22:54

Hey,
sorry it took a while to respond, I had to get some sleep Smile | :)

.

I think the correct engineering terminology is "mapping" (which I am not sure that it is what its called).
I give an example:
I created a new file A.
I copies A to B, thus B was created.
B was copies to C.

Now, I want to know that C, B and A all came from the same file (A).
Now, I thought of using FsContext2 to do that because it has unique value for each of these groups...

Hope I clearer this time...

Randor 7-Dec-08 19:18

Randor

7-Dec-08 19:18

Green Fuze wrote:

I give an example:
I created a new file A.
I copies A to B, thus B was created.
B was copies to C.
Now, I want to know that C, B and A all came from the same file (A).

Thats a very interesting idea. I forgot to ask you what operating system you are developing for. A Microsoft technology similar to what you are describing is called Single-instance storage[^] and seems to be available on some flavors of Windows Server. It seems to work by adding a mapped section to the DataSection field of the SectionObjectPointers structure of File_Object.

One final question... What operating system are you trying to develop this for?

Best Wishes,
-David Delaune

Green Fuze6-Dec-08 14:59

Does PeekMessage() always cause an infinite loop?

6-Dec-08 14:59

AND Thanks! Smile | :)

Joseph Marzbani6-Dec-08 9:50

Joseph Marzbani

6-Dec-08 9:50

I've used the following code to determine if TranslateMessage() has produced a WM_CHAR or not.

TranslateMessage( ... );
MSG msg;
while(PeekMessage(&msg,  ... , PM_NOREMOVE)
{
if(msg.message == WM_CHAR) do_some_thing();
}

But the problem lies in this that PeekMessage() never returns zero and msg.message always is equal to WM_CHAR? Confused | :confused:

Am I wrong? (of course I am Laugh | :laugh:

)

Thank you masters!

Re: Does PeekMessage() always cause an infinite loop?

Code-o-mat6-Dec-08 10:07

Code-o-mat

6-Dec-08 10:07

PM_NOREMOVE means that the message is left in the message queue, so the next time you call PeekMessage it's the same WM_CHAR you get, thus, infinite loop.

> The problem with computers is that they do what you tell them to do and not what you want them to do. <

Re: Does PeekMessage() always cause an infinite loop?

Randor 6-Dec-08 11:13

Randor

6-Dec-08 11:13

I believe you need to call the DispatchMessage Function[^] to avoid the infinite loop in that particular piece of code. What are you trying to accomplish? If you are using MFC then perhaps you should instead look for WM_CHAR in CWnd::PreTranslateMessage[^] by calling the CWnd base class and then inspecting the results.

Best Wishes,
-David Delaune

i can't add a CArray member to a class !!! error c2248 !!!

aliusam6-Dec-08 6:44

Re: i can't add a CArray member to a class !!! error c2248 !!!

6-Dec-08 6:44

my program works fine, untill i tried to add some feature.
i added a " CArray<CString> AA " to my class in the header file and the code no longer compiles, i did not refrence the variable yet and it gives me a function related error, here is the error:

1>D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxtempl.h(272) : error C2248: 'CObject::operator =' : cannot access private member declared in class 'CObject'
1> D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afx.h(554) : see declaration of 'CObject::operator ='
1> D:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afx.h(524) : see declaration of 'CObject'
1> This diagnostic occurred in the compiler generated function 'CArray<TYPE> &CArray<TYPE>::operator =(const CArray<TYPE> & )'
1> with
1> [
1> TYPE=CString
1> ]

if i comment out the line " CArray<CString> AA " the code compiles with no problem, i am using CArray in other parts in the program but not as members, they are created inside functions and they work fine

why is the error and what can i do about it?? i want to read a list from a text file that a user saves

Ali Usam AlCherchefchi

modified on Saturday, December 6, 2008 1:16 PM

Jijo.Raj6-Dec-08 9:33

Jijo.Raj

6-Dec-08 9:33

Might be due to the parameters for CArray constructor. Try this one.

CArray<CString,CString&> AA;

I hope that will fix the error. Well, if you just want to keep a list of string, you could use CStringArray as well.

Regards,
Jijo.

_____________________________________________________

http://weseetips.com[^] Visual C++ tips and tricks. Updated daily.

Re: i can't add a CArray member to a class !!! error c2248 !!!

aliusam6-Dec-08 10:56

Re: i can't add a CArray member to a class !!! error c2248 !!!

6-Dec-08 10:56

thanks for the reply but that did not help
i tried

CArray<CString,CString&> AA;

and

CStringArray AA;

same error in both cases, it is looking for the operator =, but i did not use the variable yet Confused | :confused:

Ali Usam AlCherchefchi

Jijo.Raj6-Dec-08 11:06

Jijo.Raj

6-Dec-08 11:06

Could you please post the code snippet of the whole class? So that i can have a look at it.

Regards,
Jijo.

_____________________________________________________

http://weseetips.com[^] Visual C++ tips and tricks. Updated daily.

Re: i can't add a CArray member to a class !!! error c2248 !!!

aliusam7-Dec-08 22:23

Re: i can't add a CArray member to a class !!! error c2248 !!!

7-Dec-08 22:23

hiii

this is the header:

#pragma once
#include "ga_dna.h"
#include "afxtempl.h"

#define NoOf_cValues		20
#define NoOf_rValues		51


class GA_Individual
{
public:
	GA_Individual(void);
public:
	virtual ~GA_Individual(void);
public:
	GA_DNA dna1;
           .
           .
           .
           .
           .
	// constructors
	GA_Individual(GA_DNA* pDNA);
	
	static unsigned short c[NoOf_cValues];
	static unsigned short r[NoOf_rValues];
public:
	// always call this function befor using the class to initialize it
	static bool initIndiv(void);


	CArray <CString> opamp;        //tried "	CArray <CString,CString&> opamp;
" and the same
};

the .cpp is like:

#include "StdAfx.h"
#include "GA_Individual.h"
//#define _CRT_RAND_S		// required to use rand_s()	// defined in the compiler comand line
#include "stdlib.h"
#include "windows.h"

#include <tchar.h>
#include <math.h>

unsigned short GA_Individual::c[NoOf_cValues];
unsigned short GA_Individual::r[NoOf_rValues];

GA_Individual::GA_Individual(void)
: Age(0)
{
	CArray <CString> opamp(void);   // i tried this line but it did not solve a thing
}

GA_Individual::~GA_Individual(void)
{
}

GA_Individual::GA_Individual(GA_DNA* pDNA)
{
......
}

bool GA_Individual::initIndiv(void)
{
......
}
.
....... other function definitions here
.

i noticed a thing, if i make the array a ststic ( static CArray <cstring> opamp; ) member the code compiles, i can use it as a static with few axtra lines, but i am thinking what if using it as static was not an option, one should be able to add any type to the class, right, even if it did not have the operator '=' ???

Ali Usam AlCherchefchi

Richard Andrew x646-Dec-08 15:13

Richard Andrew x64

6-Dec-08 15:13

When you put it as a member in the header file, it gets instantiated as soon as the class is instantiated. You don't need to reference it to cause it to be called.

Therefore, you need to call the constructor in the header file, like so:

CArray<cstring,cstring> AA();

Re: i can't add a CArray member to a class !!! error c2248 !!!

aliusam7-Dec-08 22:42

Re: i can't add a CArray member to a class !!! error c2248 !!!

7-Dec-08 22:42

i tried but the same error, i also tried the initialization list but the same.

Ali Usam AlCherchefchi

Snorri Kristjansson7-Dec-08 0:44

Snorri Kristjansson

7-Dec-08 0:44

"TYPE" needs to overload the '=' operator to work because when an item is added to the collection (CArray) a new instance of "TYPE" is created and the 'source' is copied into the new instance.
So for this to work you need to create a new class and overload the '=' operator to copy all data members.
BTW why don't you use CStringArray?

Re: i can't add a CArray member to a class !!! error c2248 !!!

aliusam7-Dec-08 22:34