I'm trying to develop a minifilter to control the writes of a user application in a file. I am controling each write operation in PreWrite callback. The minifilter sends all data received to another user application using FltSendMessage function before the data is written in the file.
I have develop a test user application to write in the file continously (one line each 1 second, for example), and the data received in the minifilter is different in funtion on how this test application manages this file.
If this app is develop in C, and uses for example, log4cplus to write the file, each write operation is duplicated in the minifilter, allways duplicated. But the Data->Iopb->Parameters.Write.ByteOffset said me that the two PreWrite calls are for the same file line (the offset is the same for both PreWrite calls). So I can use this ByteOffset to discart the second one (I save each PreWrite offset in a variable and compare the last offset saved with the new offset received, if both are the same, the second line is not sent with FltSendMessage because is duplicated.
if this test app is develop in Java, with a FileWriter object, the PreWrite calls are not duplicated an the offset is allways -1. This offset never changes.
Reading about this ByteOffset parameter, I thought this parameter indicated the position of the data within the file. So, why is it received allways with -1 value? The data is written in the file in the correct position, so I don't understand this behaviour.
Another thing I have test is to check Data->Iopb->Parameters.Write.Key of each PreWrite call. But it is always received with 0 value.
Does anyone have any idea how to solve this?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Writing WDF Drivers||21 Oct 2019||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|
|Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||27 Apr 2020||OSR Seminar Space & ONLINE|