Okay cool… How does this magic work?!<\/h3>\n
So you are right. Without a kernel component, there is no way to implement a filesystem. But you don’t have to write it, because Dokan did. So Dokan ships with two components: (1) dokan1.sys alias “Dokan File System Driver” (2) dokan1.dll which is used in a “Filesystem Application”. So take a look at the picture below<\/p>\n
![\"\"](\"https:\/\/craftcoders.app\/wp-content\/uploads\/2018\/08\/CraftCodeCrewFS.png\")
<\/p>\n
First, a random Application is running. It could be Word, Visual Studio, IntelliJ or your web browser rendering a website that is trying to write a virus into a file ?. Let’s assume it is the web browser. If the web browser tries to write some content x to a file y its gonna fire a I\/O-request. Secondly, the Windows I\/O Subsystem<\/em> will delegate the I\/O-request to a Driver responsible for the filesystem. In our case that would be the Dokan File System Driver<\/em>. Which is dokan1.sys<\/strong>. Please note that we did not write any code for that driver, it just needs to be installed (this is 2 in the picture above).<\/p>\n Third, our Filesystem Application<\/em> which has registered itself in the Dokan File System Driver<\/em> gets notified about the I\/O-Request. By implementing the interface which comes in the dokan1.dll<\/strong>, our Filesystem Application<\/em> is now responsible for computing the I\/O-Request. Whatever has to be done needs to be done by our Filesystem Application<\/em>. And as you might already guess: Yes this is the part we need to write! The Filesystem Application<\/em> than invokes a callback function and the Dokan File System Driver<\/em> is back in line (this is 3-4 in the picture).<\/p>\n Last but not least, the Dokan File System Driver<\/em> receives the I\/O-Response created by our Filesystem Application<\/em> and invokes the callback routine of the Windows I\/O Subsystem<\/em>. The Windows I\/O Subsystem<\/em> than forwards the result to the application which created the I\/O-Request. In our case the Web browser with the porno site (this is 5-6 in the picture).<\/p>\n Okay, we are actually not going to implement a complete Filesystem ?. That would be too much for a blog post. We are doing something simple. Let’s create a Filesystem that contains a fake file which can be read with a editor.<\/p>\n As I already mentioned before, we need to install the Dokan File System Driver<\/em>. It is used as a proxy for our Filesystem Application<\/em>. You can get the latest Version here<\/a>. First of all, we need to implement the IDokanOperations from the dokan1.dll. Since this is for learning purposes I didn’t create a second class. So everything is in one class. In the Main()-Method I create a new instance of the class and mount the Filesystem.<\/p>\n 1..2..3.. and it crashed! What happened? As you can see from the Console output, several I\/O-request failed. First, the GetVolumeInformation-Operation failed and then the Mounted-Operation. They failed because we did not implement them yet. But it’s simple: in the GetVolumeInformation-Request we just need to provide some information for the OS. Basically, this is just some Meta information for our filesystem. Like its name, how long a path can get and which feature it supports. Let’s implement it:<\/p>\n But it won’t work yet. We also need to “implement” the CreateFile-Methode:<\/p>\n Did you notice how every method returns a NtStatus? This status indicates wherever a request has failed (and why) or succeeded. You might wonder why we need to return a Success in the CreateFile-Methode for mounting the filesystem. As soon as we mount the filesystem, it tries to create some fileproxis. If we throw an exception, our filesystem ends up in a bad state.<\/p>\n Whenever the filesystem has to list files there a two possible request: FindFilesWithPattern and FindFiles. Luckily, we just need to implement one and suppress the other one. We are going to implement the FindFiles-Methode. Therefore we will return a DokanResult.NotImplemented in FindFilesWithPattern, so whenever the filesystem gets this request it will be rerouted to FindFiles. And we did it! Our filesystem now shows one file! Let’s read data from our filesystem! We want to read the string FileContent with the good old Editor. So, first of all, we need to make changes to the CreateFile-Methode. Whenever we need to open a file or dir, the CreateFile-Methode gets invoked. We need to provide the DokanFileInfo object with a context. In case of a read operation, the context is a stream where the data is located. Since we want to read a string, we are going to use a MemoryStream.<\/p>\n We are close but not quite there. When an application like Editor tries to open a file it also wants to read the meta information of the file. For example, to set the window title. Therefore we need to implement the GetFileInformation-Methode. Since our filesystem just has one file it is really trivial:<\/p>\n Now we are really close ? We just need to implement the ReadFile-Methode(). In this method, we get the Stream from the DokanFileInfo.Context and then read the bytes that have been requested. It is really as simple as this.<\/p>\n
\nThis I\/O-request is processed by the Windows I\/O Subsystem<\/em>. Note that by passing the I\/O-request to the Windows I\/O Subsystem<\/em> we leave the user mode and enter the kernel mode of Windows (this is 1 in the picture above).<\/p>\nJust do it! Writing a simple Filesystem<\/h2>\n
Scope<\/h2>\n
Warmup: Preparations<\/h2>\n
\nAs soon as we have the Dokan File System Driver installed, we can create a blank C# Console Application. Please note that you could also use Dokan with other languages<\/a>. As always, you can find my solution on GitHub<\/a>. After we’ve created the Console Application, which will be our Filesystem Application<\/em>, we need to add the Dokan library (dokan1.dll). Luckily there is a NuGet package<\/a>.
\nEverything settled? Let the game begin!<\/p>\nMount the FS<\/h2>\n
static void Main(string[] args)\r\n{\r\n var m = new StupidFS();\r\n \/\/ mounting point, dokan options, num of threads\r\n m.Mount(\"s:\\\\\", DokanOptions.DebugMode, 5);\r\n}\r\n<\/code><\/pre>\n[...]\r\n\r\npublic NtStatus GetVolumeInformation(...)\r\n{\r\n volumeLabel = \"CraftCode Crew\";\r\n features = FileSystemFeatures.None;\r\n fileSystemName = \"CCCFS\";\r\n maximumComponentLength = 256;\r\n\r\n return DokanResult.Success;\r\n}\r\n\r\n[...] \r\n\r\npublic NtStatus Mounted(DokanFileInfo info)\r\n{\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\npublic NtStatus CreateFile(...)\r\n{\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\nFaking a file<\/h2>\n
\nOne of the parameters in FindFiles is a list of FileInformation objects. We are just going to fake one item and add it to a list which will be set to the parameter files.<\/p>\npublic NtStatus FindFilesWithPattern(...)\r\n{\r\n files = null;\r\n\r\n return DokanResult.NotImplemented;\r\n}\r\n\r\npublic NtStatus FindFiles(...)\r\n{\r\n var fileInfo = new FileInformation\r\n {\r\n FileName = \"carftCodeCrew.txt\",\r\n CreationTime = DateTime.Now,\r\n LastAccessTime = DateTime.Now,\r\n LastWriteTime = DateTime.Now,\r\n Length = FileContent.Length * 8,\r\n };\r\n\r\n files = new List<FileInformation> {fileInfo};\r\n\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\n
\nDid you notice FileContent? It’s just a global string containing the content of our textfile.<\/p>\nReading with the good old Editor<\/h2>\n
public NtStatus CreateFile(...)\r\n{\r\n if (fileName.Equals(@\"\\carftCodeCrew.txt\"))\r\n {\r\n info.Context = new MemoryStream(System.Text.Encoding.ASCII.GetBytes(FileContent));\r\n }\r\n\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\npublic NtStatus GetFileInformation(...)\r\n{\r\n fileInfo = new FileInformation\r\n {\r\n FileName = \"carftCodeCrew.txt\",\r\n Attributes = 0,\r\n CreationTime = DateTime.Now,\r\n LastAccessTime = DateTime.Now,\r\n LastWriteTime = DateTime.Now,\r\n Length = FileContent.Length * 8,\r\n };\r\n\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\npublic NtStatus ReadFile(...)\r\n{\r\n bytesRead = 0;\r\n\r\n if (info.Context is MemoryStream stream)\r\n {\r\n stream.Position = offset;\r\n bytesRead = stream.Read(buffer, 0, buffer.Length);\r\n }\r\n\r\n return DokanResult.Success;\r\n}\r\n<\/code><\/pre>\nThe lovely CraftCodeCrewFS<\/h2>\n
![\"\"](\"https:\/\/craftcoders.app\/wp-content\/uploads\/2018\/08\/CraftCodeCrewFSResult.gif\")
<\/p>\n","protected":false},"excerpt":{"rendered":"