I’m trying to determine if a write happens at the end of a file inside my
minifilter. Sometimes the Parameters.Write.ByteOffset indicates that, but
other times it only indicates that the write is happening at the “current
file position”. In those case I’m doing roughly the following in my
PostOperationCallback function:
switch(Data->Iopb->MajorFunction)
{
case IRP_MJ_WRITE:
if(PASSIVE_LEVEL == KeGetCurrentIrql())
{
unsigned char buff1[sizeof(FILE_POSITION_INFORMATION) *
2];
unsigned char* pBuffPosInfo = buff1;
//use current file pointer – is it at the end?
pBuffPosInfo = (unsigned
char*)ROUND_TO_64BIT((__int64)pBuffPosInfo);
if(STATUS_SUCCESS ==
FltQueryInformationFile(Data->Iopb->TargetInstance,
Data->Iopb->TargetFileObject, pBuffPosInfo,
sizeof(FILE_POSITION_INFORMATION), FilePositionInformation, NULL))
{
unsigned char
buff2[sizeof(FILE_STANDARD_INFORMATION) * 2];
unsigned char* pBuffStdInfo = buff2;
pBuffStdInfo = (unsigned
char*)ROUND_TO_64BIT((__int64)pBuffStdInfo);
if(STATUS_SUCCESS ==
FltQueryInformationFile(Data->Iopb->TargetInstance,
Data->Iopb->TargetFileObject, pBuffStdInfo,
sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation, NULL))
{
if(((FILE_POSITION_INFORMATION*)pBuffPosInfo)->CurrentByteOffset.QuadPart >=
((FILE_STANDARD_INFORMATION*)pBuffStdInfo)->EndOfFile.QuadPart)
//write was at the end!!
}
}
}
break;
}
This seemed to work well (as far as I’ve tested so far), but I’ve discovered
that my minifilter no longer unloads, and the calls to
FltQueryInformationFile were the only changes made. Do I need to somehow
undo this call, or perhaps only do it in the PreOperationCallback? Any
other thoughts?
Thanks for any feedback.
Doug