FltReadFile in PostCreate using FILE_OBJECT

NTFSD
1

Hi,

I have query regarding reading file using FltReadFile using FILE_OBJECT in postCreate.
currenlty I am able read file in PostCreate. but I have query,
Do I need to align my readBuffer in accordance with the alignment requirement of the storage device if user mode
ZwCreateFile/NtCreateFile initiated using CreateOptions “FILE_NO_INTERMEDIATE_BUFFERING”?

As per msdn for NtCreateFile it suggests to align buffer,
“CreateOptions FILE_NO_INTERMEDIATE_BUFFERING flag prevents the file system from performing any intermediate buffering on behalf of the caller.
-Any optional ByteOffset passed to the NtReadFile or NtWriteFile function must be an integral of the sector size.
-The Length passed to NtReadFile or NtWriteFile, must be an integral of the sector size”

Any pointers will really help.

Thanks,
Sachin

2

Yes.

Filter Manager Verifier will fail your driver if you do not properly align
your buffer and length in this case.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hi,

I have query regarding reading file using FltReadFile using FILE_OBJECT in
postCreate.
currenlty I am able read file in PostCreate. but I have query,
Do I need to align my readBuffer in accordance with the alignment
requirement of the storage device if user mode
ZwCreateFile/NtCreateFile initiated using CreateOptions
“FILE_NO_INTERMEDIATE_BUFFERING”?

As per msdn for NtCreateFile it suggests to align buffer,
“CreateOptions FILE_NO_INTERMEDIATE_BUFFERING flag prevents the file system
from performing any intermediate buffering on behalf of the caller.
-Any optional ByteOffset passed to the NtReadFile or NtWriteFile function
must be an integral of the sector size.
-The Length passed to NtReadFile or NtWriteFile, must be an integral of the
sector size”

Any pointers will really help.

Thanks,
Sachin

3

Thanks Scott for clarifying query.

4

I believe also if the file is not opened for synchronous I/O you must
specify the byte offset on each read/write as it will not update the byte
offset. But I guess this is if you make multiple reads/write that are
supposed to be sequential.

Gabriel.
www.kasardia.com

On Thu, Oct 13, 2016 at 6:57 AM, wrote:

> Thanks Scott for clarifying query.
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
>

–
Bercea. G.</http:>