Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Word and Wordpad

OSR_Community_UserOSR_Community_User Member Posts: 110,217
i noticed there is a difference between Word and Wordpad opening .doc files.
my file system filter driver can see the IRP_MJ_READ irps from Word but not
one from Wordpad requesting for the file contents.

is there any other way that Wordpad is reading documents?

@@
<" )~ Be yourself...
/\/\ Ho Mun Chuen

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    i do see some reads for small sizes like 2 bytes, 4 bytes, 8 bytes, etc
    starting from offset 0 but not anything larger than 8 bytes. i have sort of
    disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
    instead all along. well, what i did extra was to add a header to the files
    and would offset any reads or writes with the length of this header before
    sending it down, after which in the completion routine i would reset it back
    to what it was supposed to reflect. *sigh*, this works for Notepad and Word
    but not Wordpad... i always thought Word would be a more difficult
    application to handle...

    @@
    <" )~ Be yourself...
    /\/\ Ho Mun Chuen
    ----- Original Message -----
    From: I?aki Castillo <[email protected]>
    To: File Systems Developers Interest List <[email protected]>
    Sent: Thursday, February 24, 2000 6:28 PM
    Subject: [ntfsd] RE: Word and Wordpad


    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')

    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    >to what it was supposed to reflect. *sigh*, this works for Notepad and Word
    >but not Wordpad... i always thought Word would be a more difficult

    Looks like WordPad uses memory-mapped files to open the document.

    Max
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > Worpad maps the file in memory so the remainder Reads may come
    > through FastIO.

    Page faults of memory mapped file NEVER go via FastIO - they always go
    via IRP.

    Max
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    You can write a simple test app:
    hFile = CreateFile(pszFile,
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL);

    if (hFile != INVALID_HANDLE_VALUE) {
    if ((ulSize = GetFileSize(hFile, NULL)) > 0) {
    hFileMap = CreateFileMapping(hFile, NULL,
    PAGE_READONLY, 0, 0, NULL);
    if (hFileMap != NULL) {
    lpvFile =
    MapViewOfFile(hFileMap,dwMapDesired, 0, 0, 0);
    if (lpvFile != NULL) {
    // Copy some data from lpvFile
    to a temporary buffer

    UnmapViewOfFile(lpvFile);
    }
    CloseHandle(hFileMap);
    }
    }
    CloseHandle(hFile );
    }
    and compare the data with the data you get by CreateFile + ReadFile.
    This simple app ilustrates majority of problems with metadata stored
    at the beginning of the file. I hope it also answer your question
    about Word and WordPad.

    Bests regards
    mari

    -----------------
    Milostav MARIK
    DECROS spol. s.r.o.
    Czech Republic
    -----------------

    -----Original Message-----
    From: Ho Mun Chuen [mailto:[email protected]]
    Sent: Thursday, February 24, 2000 12:11 PM
    To: File Systems Developers Interest List
    Subject: [ntfsd] RE: Word and Wordpad


    i do see some reads for small sizes like 2 bytes, 4 bytes, 8 bytes,
    etc
    starting from offset 0 but not anything larger than 8 bytes. i have
    sort of
    disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
    instead all along. well, what i did extra was to add a header to the
    files
    and would offset any reads or writes with the length of this header
    before
    sending it down, after which in the completion routine i would reset
    it back
    to what it was supposed to reflect. *sigh*, this works for Notepad and
    Word
    but not Wordpad... i always thought Word would be a more difficult
    application to handle...

    @@
    <" )~ Be yourself...
    /\/\ Ho Mun Chuen
    ----- Original Message -----
    From: Inaki Castillo <[email protected]>
    To: File Systems Developers Interest List
    Sent: Thursday, February 24, 2000 6:28 PM
    Subject: [ntfsd] RE: Word and Wordpad


    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per
    file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening
    .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word
    but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')

    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')



    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 20 Apr 2020 LIVE ONLINE
Writing WDF Drivers 11 May 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA