Accessing data in IRP_MJ_WRITE

NTFSD
1

Hello Folks,

I have a filter driver the intercepts open, read and write operations. When I copy a file remotely (via a network share) to a machine running my filter driver, the filter driver gets the IRP_MJ_WRITE, however I don’t get the data, the Iopb->Parameters.Write.MdlAddress and the Iopb->Parameters.Write.WriteBuffer are both NULL but the Iopb->Parameters.Write.Length is > 0. I have also checked that it is an IRP operation and not a Fast IO. I am registering my write callback as below:

{
IRP_MJ_WRITE,
FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO,
PreWriteCallback,
NULL
},

What is going on? Please help.

2

Have you checked for IRP_MN_MDL?

3

Yes. I also read elsewhere that when this minor code is set the MdlAddress and UserBuffer field will both be NULL. I looked at the SwapBuffers sample, which does something in the completion routine. However, in my case I may want to take certain decision based on the data I see in “PreWrite”.
So the question is will I ever see data in “PreWrite” when I copy files remotely?

Thanks for your help.

4

> So the question is will I ever see data in “PreWrite” when I copy files

remotely?

Yes - empirically SRV will decide based on size whether to do a normal write
or and IRP_MN_MDL write.

Have you looked at the corresponding IRP_MN_COMPLETE calls? They may
provide you with some assistance (I’ve never looked closely so this is
speculation and there are others, much more experienced than I, who could
comment better).

5

I’ll look into IRP_MN_COMPLETE, but I don’t think I ever get any other prewrite for the same file, but I’ll double check on this. Thanks for the info.

6

Hi Rod

I think the OP has mini-filter; in this case IRP_MJ_WRITE callback does not
receive the IRP_MN_MDL paths. Instead the IRP_MJ_MDL_WRITE_COMPLETE would be
more relevant?

Best Wishes
Lyndon

“Rod Widdowson” wrote in message
news:xxxxx@ntfsd…
> Have you checked for IRP_MN_MDL?
>
>

7

Yes, I have a mini-filter and I do receive IRP_MN_MDL. Infact I don’t receive any other IRP_MJ_WRITE for the same file. I may be doing something that could be causing it, but I am not sure and I am going to further investigate this.
As long as the experts in this forum confirm that the filter driver will receive the data eventually in the “PreWrite” with some minor code, I am fine, otherwise I’ll always be in a doubt whether I am doing something wrong or I am not looking at right place.

Thanks.