Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

FltCreateSectionForDataScan and Network redirector

Anand_ChoubeyAnand_Choubey Member Posts: 24

I am working on minifilter driver, my driver scans files at IRP_MJ_CLEANUP and it blocks IRP_MJ_CLEANUP until scan is not completed.

To scan file, FltCreateSectionForDataScan is being used to open memory mapped section in driver and userland app can open memory mapping using MapViewOfFile, and scan the file content.

Things work fine on local NTFS system.

But problem is with share folder, driver can open section handle using FltCreateSectionForDataScan and userland app can read file content using MapViewOfFile for remote files.

BUT 'sometimes' complete data is not saved at remote machine.

Suppose, I create a file using notepad or any app on share folder, this share folder has all access rights, type few lines and close the app, app tries to save the data at remote location before closing the file.
FltGetFileSize method returns correct file size but my memory mapped file does not show complete contents and complete contents are not saved into remote file. I open file again some part of file is not saved earlier therefore complete file content is not shown in editor.

I do not understand where to start looking the issue, is this issue related with oplock?

Please suggest me, what should I go forward?



  • NtDev_GeekNtDev_Geek Member - All Emails Posts: 95
    put a check for remote access only and use
    MmFlushXXX routine hope it may help.u don't own the re-directors cache.
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,021
    We've used this API several times, but I don't think we've ever used it on the network. Which version of Windows are you running? Also, what's the SMB version of the connection (you can use Get-SmbConnection in PowerShell to get this information)?

    Last data point: do you see this behavior if you use the AvScan minifilter sample?



Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!