FltCreateSectionForDataScan and Network redirector

NTFSD
1

Hi,

I am working on minifilter driver, my driver scans files at IRP_MJ_CLEANUP and it blocks IRP_MJ_CLEANUP until scan is not completed.

To scan file, FltCreateSectionForDataScan is being used to open memory mapped section in driver and userland app can open memory mapping using MapViewOfFile, and scan the file content.

Things work fine on local NTFS system.

But problem is with share folder, driver can open section handle using FltCreateSectionForDataScan and userland app can read file content using MapViewOfFile for remote files.

BUT ‘sometimes’ complete data is not saved at remote machine.

Suppose, I create a file using notepad or any app on share folder, this share folder has all access rights, type few lines and close the app, app tries to save the data at remote location before closing the file.
FltGetFileSize method returns correct file size but my memory mapped file does not show complete contents and complete contents are not saved into remote file. I open file again some part of file is not saved earlier therefore complete file content is not shown in editor.

I do not understand where to start looking the issue, is this issue related with oplock?

Please suggest me, what should I go forward?

Thanks
Anand

2

put a check for remote access only and use
MmFlushXXX routine hope it may help.u don’t own the re-directors cache.

3

We’ve used this API several times, but I don’t think we’ve ever used it on the network. Which version of Windows are you running? Also, what’s the SMB version of the connection (you can use Get-SmbConnection in PowerShell to get this information)?

Last data point: do you see this behavior if you use the AvScan minifilter sample?

-scott
OSR
@OSRDrivers