Hello, I asked this some days ago but I couldn’t follow the answers I had
problems with the server for a pair of weeks. So please, answer me again.
Hello.
I’m writing a driver to control access to boot sector. So I attach to
\HardDiskN\PartitionN. I was told that to know if boot sector was being
accessed to check
currentIrpStack->Parameters.Read.ByteOffset
ByteOffset is a LARGE_INTEGER that indicates the sector being accessed.
So if this number is 0 I got an access to boot sector. But in a normal
file save (a .txt for example) I get (ByteOffset == 0). As well
ByteOffset.LowPart as ByteOffset.LowPart.
Am I doing something wrong?
My driver starts at boot time so I guess it does attach to the physical
device.
Is it OK to create a device to comunicate with this driver although it
does not handle IRP_MJ_CLOSE messages?
Thank you.