Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 9-13 Sept 2024 | Live, Online |
Developing Minifilters | 15-19 July 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 20-24 May 2024 | Live, Online |
Comments
Worpad maps the file in memory so the remainder Reads may come
through FastIO.
In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.
Inaki.
> -----Original Message-----
> From: Ho Mun Chuen
> Sent: jueves 24 de febrero de 2000 6:01
> To: File Systems Developers Interest List
> Subject: [ntfsd] Word and Wordpad
>
> i noticed there is a difference between Word and Wordpad opening .doc
> files.
> my file system filter driver can see the IRP_MJ_READ irps from Word but
> not
> one from Wordpad requesting for the file contents.
>
> is there any other way that Wordpad is reading documents?
>
> @@
> <" )~ Be yourself...
> /\/\ Ho Mun Chuen
>
>
>
> ---
> You are currently subscribed to ntfsd as: [email protected]
> To unsubscribe send a blank email to $subst('Email.Unsub')
starting from offset 0 but not anything larger than 8 bytes. i have sort of
disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
instead all along. well, what i did extra was to add a header to the files
and would offset any reads or writes with the length of this header before
sending it down, after which in the completion routine i would reset it back
to what it was supposed to reflect. *sigh*, this works for Notepad and Word
but not Wordpad... i always thought Word would be a more difficult
application to handle...
@@
<" )~ Be yourself...
/\/\ Ho Mun Chuen
----- Original Message -----
From: I?aki Castillo <[email protected]>
To: File Systems Developers Interest List <[email protected]>
Sent: Thursday, February 24, 2000 6:28 PM
Subject: [ntfsd] RE: Word and Wordpad
You should at least see one IRP_MJ_READ.
Worpad maps the file in memory so the remainder Reads may come
through FastIO.
In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.
Inaki.
> -----Original Message-----
> From: Ho Mun Chuen
> Sent: jueves 24 de febrero de 2000 6:01
> To: File Systems Developers Interest List
> Subject: [ntfsd] Word and Wordpad
>
> i noticed there is a difference between Word and Wordpad opening .doc
> files.
> my file system filter driver can see the IRP_MJ_READ irps from Word but
> not
> one from Wordpad requesting for the file contents.
>
> is there any other way that Wordpad is reading documents?
>
> @@
> <" )~ Be yourself...
> /\/\ Ho Mun Chuen
>
>
>
> ---
> You are currently subscribed to ntfsd as: [email protected]
> To unsubscribe send a blank email to $subst('Email.Unsub')
---
You are currently subscribed to ntfsd as: [email protected]
To unsubscribe send a blank email to $subst('Email.Unsub')
>but not Wordpad... i always thought Word would be a more difficult
Looks like WordPad uses memory-mapped files to open the document.
Max
> through FastIO.
Page faults of memory mapped file NEVER go via FastIO - they always go
via IRP.
Max
hFile = CreateFile(pszFile,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
if (hFile != INVALID_HANDLE_VALUE) {
if ((ulSize = GetFileSize(hFile, NULL)) > 0) {
hFileMap = CreateFileMapping(hFile, NULL,
PAGE_READONLY, 0, 0, NULL);
if (hFileMap != NULL) {
lpvFile =
MapViewOfFile(hFileMap,dwMapDesired, 0, 0, 0);
if (lpvFile != NULL) {
// Copy some data from lpvFile
to a temporary buffer
UnmapViewOfFile(lpvFile);
}
CloseHandle(hFileMap);
}
}
CloseHandle(hFile );
}
and compare the data with the data you get by CreateFile + ReadFile.
This simple app ilustrates majority of problems with metadata stored
at the beginning of the file. I hope it also answer your question
about Word and WordPad.
Bests regards
mari
-----------------
Milostav MARIK
DECROS spol. s.r.o.
Czech Republic
-----------------
-----Original Message-----
From: Ho Mun Chuen [mailto:[email protected]]
Sent: Thursday, February 24, 2000 12:11 PM
To: File Systems Developers Interest List
Subject: [ntfsd] RE: Word and Wordpad
i do see some reads for small sizes like 2 bytes, 4 bytes, 8 bytes,
etc
starting from offset 0 but not anything larger than 8 bytes. i have
sort of
disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
instead all along. well, what i did extra was to add a header to the
files
and would offset any reads or writes with the length of this header
before
sending it down, after which in the completion routine i would reset
it back
to what it was supposed to reflect. *sigh*, this works for Notepad and
Word
but not Wordpad... i always thought Word would be a more difficult
application to handle...
@@
<" )~ Be yourself...
/\/\ Ho Mun Chuen
----- Original Message -----
From: Inaki Castillo <[email protected]>
To: File Systems Developers Interest List
Sent: Thursday, February 24, 2000 6:28 PM
Subject: [ntfsd] RE: Word and Wordpad
You should at least see one IRP_MJ_READ.
Worpad maps the file in memory so the remainder Reads may come
through FastIO.
In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per
file.
Inaki.
> -----Original Message-----
> From: Ho Mun Chuen
> Sent: jueves 24 de febrero de 2000 6:01
> To: File Systems Developers Interest List
> Subject: [ntfsd] Word and Wordpad
>
> i noticed there is a difference between Word and Wordpad opening
.doc
> files.
> my file system filter driver can see the IRP_MJ_READ irps from Word
but
> not
> one from Wordpad requesting for the file contents.
>
> is there any other way that Wordpad is reading documents?
>
> @@
> <" )~ Be yourself...
> /\/\ Ho Mun Chuen
>
>
>
> ---
> You are currently subscribed to ntfsd as: [email protected]
> To unsubscribe send a blank email to $subst('Email.Unsub')
---
You are currently subscribed to ntfsd as: [email protected]
To unsubscribe send a blank email to $subst('Email.Unsub')
---
You are currently subscribed to ntfsd as: [email protected]
To unsubscribe send a blank email to $subst('Email.Unsub')