The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I learned that when you try to write less than the sector size using WriteFile when the handle is PhysicalDrive, you'll get the error ERROR_INVALID_PARAMETER, and based on other questions asked here its because when writing to disk the size parameter of the WriteFile has to be multiplicand of the sector size.
so basically i have three questions:
why is it OK to write any number of bytes when the handle is a normal file handle? i want to know the detail, is it because a different driver gets the IRP requests when i open the handle to PhysicalDrive compared to a normal file and that driver behaves differently? and if so, what are the drivers responsible for each of them?
isn't this really redundant? meaning if i want to just write 4 byte in a sector, i have to first read the content of it and then modify the 4 byte and then write the entire sector back! isn't there a faster way to do this?
is there anyway to bypass this and somehow only write a small amount of bytes in a sector? (i don't care what the handle is)
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|