Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Internals & Software Drivers | 19-23 June 2023 | Live, Online |
Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Kernel Debugging | 16-20 October 2023 | Live, Online |
Developing Minifilters | 13-17 November 2023 | Live, Online |
Comments
Yes. you may (depending on the FSD) need to provide a sector aligned input buffer and rely on the FSD to truncate to EOF.
But... why not just try this with FileTest? Sure it's not using FltMgr calls, but it all ends up in the same place.
Are you calling FtlReadFile while in a paging I/O path?
Sector aligned input does work, regardless of unaligned output. As long as
input offset is not beyond EOF of course.
The FltReadFile call doing non cached io is deep down in a module handling
1- Aligned input buffer ( Using. FltAllocatePoolAlignedWithTag)
2 - Sector aligned offset.
3 - Sector aligned length.
Now if the file size is not sector aligned, how do we read the last few non aligned bytes till EOF.
Can we specify a non sector aligned length for this special case? Because reading past the EOF will a sector aligned buffer length is failing with FltReadFile.
return status on failure of FltReadFile is (-1073741807) (0x3FFFFFEF)
This enc driver is not using an isolation filter model but is buold up on the SwapBuffers example.
Pardon me for I am incoherent because of lack of sleep. This is a success error status but the BytesRead is returned as Zero in the special case while reading the last few bytes till EOF.
No, this is not a success status, it is 0xC0000011 which is STATUS_END_OF_FILE. Are you certain the byte offset you are providing is before the EoF?
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
BR