Comments

• rod_widdowson Member - All Emails Posts: 1,224

  December 2020

  I’ve always used FltPerformSynchronousIo (and FltAllocateCallbackData &c).

  There is a minor function (since win7 I think) to turn a MJ_FLUSH into flush & purge.

  0 · Share on Facebook
• sagi_zar Member - All Emails Posts: 35

  December 2020

  The minifilter is not initiating the write requests to the file.
  I want to flush and purge the cache that was updated by write and read requests that user applications did and the driver monitored

  0 · Share on Facebook
• Scott_Noone_(OSR) Administrator Posts: 3,482

  January 2021

  FltFlushBuffers2 is just a wrapper around sending an IRP_MJ_FLUSH_BUFFERS with various different minor function codes:

  //
  // Flush minor function codes
  //
  
  #define IRP_MN_FLUSH_AND_PURGE           0x01
  #if (NTDDI_VERSION >= NTDDI_WIN8)
  #define IRP_MN_FLUSH_DATA_ONLY           0x02    //see FLUSH_FLAGS_FILE_DATA_ONLY for definition of how this works
  #define IRP_MN_FLUSH_NO_SYNC             0x03    //see FLUSH_FLAGS_NO_SYNC for definition of how this works
  #endif
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
  #define IRP_MN_FLUSH_DATA_SYNC_ONLY      0x04    //see FLUSH_FLAGS_FILE_DATA_SYNC_ONLY for definition of how this works
  #endif
  

  As Rod said you can just build your own callback data instead of using this API.

  Note however that it's up to the file system to actually implement these minor function code. For example, I don't believe FAT uses any of them.

  -scott
  OSR

  0 · Share on Facebook
• MKS Member Posts: 2

  April 2021

  I've got the same issue as Sagi, and while sending the IRP directly does work (thanks Rod and Scott!), my Lead would rather I use the "documented" way of doing things. As such, I'm trying to use FltFlushBuffers2() if it is available. To check the availability, I'm using MmGetSystemRoutineAddress():

  PFN_FLT_FLUSH_BUFFERS_2 pFltFlushBuffers2 = NULL;
  UNICODE_STRING FltFlushBuffers2_Text;
  RtlInitUnicodeString(&FltFlushBuffers2_Text, L"FltFlushBuffers2");
  pFltFlushBuffers2 = (PFN_FLT_FLUSH_BUFFERS_2) (ULONG_PTR)MmGetSystemRoutineAddress(&FltFlushBuffers2_Text);

  Although I'm testing on Windows 10 2H20, this always returns NULL. It also returns NULL for FltFlushBuffers and FltCancelIo. The same code works for MmMapIoSpaceEx() in my driver.

  Is there a different way of getting the addresses of Filter Manager functions?

  Thanks,
  Merrill

  0 · Share on Facebook
• rod_widdowson Member - All Emails Posts: 1,224

  April 2021

  You need FltGetRoutineAddress

  0 · Share on Facebook
• MKS Member Posts: 2

  April 2021

  Thanks Rod, this works perfectly.
  Merrill

  0 · Share on Facebook