Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Reading last few odd bytes using FltReadFile in non-cached mode

VN_RajuVN_Raju Member Posts: 17
Will FltReadFile succeed if used in non-cached mode having sector non aligned length while reading the last few bytes before EOF.


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,243

    Yes. you may (depending on the FSD) need to provide a sector aligned input buffer and rely on the FSD to truncate to EOF.

    But... why not just try this with FileTest? Sure it's not using FltMgr calls, but it all ends up in the same place.

  • VN_RajuVN_Raju Member Posts: 17
    The FltReadFile call doing non cached io is deep down in a module handling encryption of sparse files. And if I specify a sector aligned multiple for length (greater than EOF) to read the last few bytes till EOF, then FltReadFile fails.
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 544
    via Email
    What error does it give?
    Are you calling FtlReadFile while in a paging I/O path?

    Sector aligned input does work, regardless of unaligned output. As long as
    input offset is not beyond EOF of course.

    The FltReadFile call doing non cached io is deep down in a module handling
  • VN_RajuVN_Raju Member Posts: 17
    So my question is while doing non cached reads with the FltReadFile, the requirements are:
    1- Aligned input buffer ( Using. FltAllocatePoolAlignedWithTag)
    2 - Sector aligned offset.
    3 - Sector aligned length.

    Now if the file size is not sector aligned, how do we read the last few non aligned bytes till EOF.

    Can we specify a non sector aligned length for this special case? Because reading past the EOF will a sector aligned buffer length is failing with FltReadFile.
  • VN_RajuVN_Raju Member Posts: 17
    The FltReadFile is in the cached io path.
  • VN_RajuVN_Raju Member Posts: 17

    return status on failure of FltReadFile is (-1073741807) (0x3FFFFFEF)

  • VN_RajuVN_Raju Member Posts: 17

    This enc driver is not using an isolation filter model but is buold up on the SwapBuffers example.

  • VN_RajuVN_Raju Member Posts: 17

    Pardon me for I am incoherent because of lack of sleep. This is a success error status but the BytesRead is returned as Zero in the special case while reading the last few bytes till EOF.

  • Peter_ScottPeter_Scott Member - All Emails Posts: 751

    No, this is not a success status, it is 0xC0000011 which is STATUS_END_OF_FILE. Are you certain the byte offset you are providing is before the EoF?

    Kernel Drivers
    Windows File System and Device Driver Consulting

  • VN_RajuVN_Raju Member Posts: 17
    Thanks Pete! I don’t have access to the code right now. Will update you on this later in the day but I am pretty certain that this is the cause. Thanks for helping and also for all your help in a previous life.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 19-23 June 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online