In win10,my minifilter have disabled local buffering(by IOCTL_LMR_DISABLE_LOCAL_BUFFERING or oplock break),I observed a strange situation:
There is a test.text on \192.168.2.222\test,and the length of test.text is 0x2A.I opened the test.txt by notepad,and append some text,and then close it(save the file).
1.notepad cached write (offset:0x0,length:0x4B).
2.notepad paging write (offset:0x0,length:0x1000).and the top-level IRP is not NULL,the top level IRP is a 64bit pointer.(I think it is a cleanup IRP).
3.notepad cleanup.
Anybody can explain it?
1.When notepad cached write,because I have disabled local buffering,why this cached write does not write to the remote side?
In remote(192.168.2.222),I can’t observed the write.
2.I have disabled local buffering,why the cleanup will issued nested paging write?