Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

file object used in paging write is for a deleted name

milosdmilosd Member Posts: 4

I'm filtering writes and need to record what name a write is made with. In my test case, a new stream is created then a couple of hard links are created. A delete is performed using the first name. A write is made using the second hard link. The problem is that if the write is cached, the file object passed to the pre and post-write callbacks is for the first name. I need to reflect the actual name used for the write but I'm not sure how to get the "correct" file object. Non-cached writes aren't a problem.

I know how the cache manager initiates caching so I'm looking for a way to get around the annoying behavior of receiving the original file object and get the one used in the write so I can resolve the correct name. In my application, the name is imperative for proper operation and verification.


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,088

    I'm aware that this isn't the answer you need, but by the time that paging happens the name is completely irrelevant, therefore there can be no "proper operation or verification". You can open one link for read and one for write and the paging writes can happen to the read file object.

    If you really care you should be worrying about the cached and non buffered IO and section creation.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,515
    edited October 8

    In my application, the name is imperative for proper operation and verification

    What Dr. Widdowson said.

    I’m sorry to tell you that your design is faulty. That’s just not the way Windows works. If there are multiple writers to a cached file... and the data finally gets written to disk by Cc. who is then considered the writer?

    You could filter the individual user writes to the cache, but in that case... how will you account for (the commonly used) memory mapped I/O?

    Yeah... I’m afraid you’re in a bit of a bind. The best you can do is audit which files are opened for write access, and then note that they’ve been written. But you really can’t know who wrote what to a given file.


    Peter Viscarola

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE