Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Word and Wordpad

OSR_Community_UserOSR_Community_User Member Posts: 110,217
i noticed there is a difference between Word and Wordpad opening .doc files.
my file system filter driver can see the IRP_MJ_READ irps from Word but not
one from Wordpad requesting for the file contents.

is there any other way that Wordpad is reading documents?

@@
<" )~ Be yourself...
/\/\ Ho Mun Chuen

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    i do see some reads for small sizes like 2 bytes, 4 bytes, 8 bytes, etc
    starting from offset 0 but not anything larger than 8 bytes. i have sort of
    disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
    instead all along. well, what i did extra was to add a header to the files
    and would offset any reads or writes with the length of this header before
    sending it down, after which in the completion routine i would reset it back
    to what it was supposed to reflect. *sigh*, this works for Notepad and Word
    but not Wordpad... i always thought Word would be a more difficult
    application to handle...

    @@
    <" )~ Be yourself...
    /\/\ Ho Mun Chuen
    ----- Original Message -----
    From: I?aki Castillo <[email protected]>
    To: File Systems Developers Interest List <[email protected]>
    Sent: Thursday, February 24, 2000 6:28 PM
    Subject: [ntfsd] RE: Word and Wordpad


    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')

    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    >to what it was supposed to reflect. *sigh*, this works for Notepad and Word
    >but not Wordpad... i always thought Word would be a more difficult

    Looks like WordPad uses memory-mapped files to open the document.

    Max
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > Worpad maps the file in memory so the remainder Reads may come
    > through FastIO.

    Page faults of memory mapped file NEVER go via FastIO - they always go
    via IRP.

    Max
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    You can write a simple test app:
    hFile = CreateFile(pszFile,
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL);

    if (hFile != INVALID_HANDLE_VALUE) {
    if ((ulSize = GetFileSize(hFile, NULL)) > 0) {
    hFileMap = CreateFileMapping(hFile, NULL,
    PAGE_READONLY, 0, 0, NULL);
    if (hFileMap != NULL) {
    lpvFile =
    MapViewOfFile(hFileMap,dwMapDesired, 0, 0, 0);
    if (lpvFile != NULL) {
    // Copy some data from lpvFile
    to a temporary buffer

    UnmapViewOfFile(lpvFile);
    }
    CloseHandle(hFileMap);
    }
    }
    CloseHandle(hFile );
    }
    and compare the data with the data you get by CreateFile + ReadFile.
    This simple app ilustrates majority of problems with metadata stored
    at the beginning of the file. I hope it also answer your question
    about Word and WordPad.

    Bests regards
    mari

    -----------------
    Milostav MARIK
    DECROS spol. s.r.o.
    Czech Republic
    -----------------

    -----Original Message-----
    From: Ho Mun Chuen [mailto:[email protected]]
    Sent: Thursday, February 24, 2000 12:11 PM
    To: File Systems Developers Interest List
    Subject: [ntfsd] RE: Word and Wordpad


    i do see some reads for small sizes like 2 bytes, 4 bytes, 8 bytes,
    etc
    starting from offset 0 but not anything larger than 8 bytes. i have
    sort of
    disabled FastIo by returning FALSE so that IRP_MJ_READs would be used
    instead all along. well, what i did extra was to add a header to the
    files
    and would offset any reads or writes with the length of this header
    before
    sending it down, after which in the completion routine i would reset
    it back
    to what it was supposed to reflect. *sigh*, this works for Notepad and
    Word
    but not Wordpad... i always thought Word would be a more difficult
    application to handle...

    @@
    <" )~ Be yourself...
    /\/\ Ho Mun Chuen
    ----- Original Message -----
    From: Inaki Castillo <[email protected]>
    To: File Systems Developers Interest List
    Sent: Thursday, February 24, 2000 6:28 PM
    Subject: [ntfsd] RE: Word and Wordpad


    You should at least see one IRP_MJ_READ.
    Worpad maps the file in memory so the remainder Reads may come
    through FastIO.
    In my system (NT4.0ServerSP4) Worpad generates two IRP_MJ_READ per
    file.

    Inaki.

    > -----Original Message-----
    > From: Ho Mun Chuen
    > Sent: jueves 24 de febrero de 2000 6:01
    > To: File Systems Developers Interest List
    > Subject: [ntfsd] Word and Wordpad
    >
    > i noticed there is a difference between Word and Wordpad opening
    .doc
    > files.
    > my file system filter driver can see the IRP_MJ_READ irps from Word
    but
    > not
    > one from Wordpad requesting for the file contents.
    >
    > is there any other way that Wordpad is reading documents?
    >
    > @@
    > <" )~ Be yourself...
    > /\/\ Ho Mun Chuen
    >
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')

    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')



    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 9-13 Sept 2024 Live, Online
Developing Minifilters 15-19 July 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online