Accessing data in IRP_MJ_WRITE

Hello Folks,

I have a filter driver the intercepts open, read and write operations. When I copy a file remotely (via a network share) to a machine running my filter driver, the filter driver gets the IRP_MJ_WRITE, however I don’t get the data, the Iopb->Parameters.Write.MdlAddress and the Iopb->Parameters.Write.WriteBuffer are both NULL but the Iopb->Parameters.Write.Length is > 0. I have also checked that it is an IRP operation and not a Fast IO. I am registering my write callback as below:


What is going on? Please help.

Have you checked for IRP_MN_MDL?

Yes. I also read elsewhere that when this minor code is set the MdlAddress and UserBuffer field will both be NULL. I looked at the SwapBuffers sample, which does something in the completion routine. However, in my case I may want to take certain decision based on the data I see in “PreWrite”.
So the question is will I ever see data in “PreWrite” when I copy files remotely?

Thanks for your help.

> So the question is will I ever see data in “PreWrite” when I copy files


Yes - empirically SRV will decide based on size whether to do a normal write
or and IRP_MN_MDL write.

Have you looked at the corresponding IRP_MN_COMPLETE calls? They may
provide you with some assistance (I’ve never looked closely so this is
speculation and there are others, much more experienced than I, who could
comment better).

I’ll look into IRP_MN_COMPLETE, but I don’t think I ever get any other prewrite for the same file, but I’ll double check on this. Thanks for the info.

Hi Rod

I think the OP has mini-filter; in this case IRP_MJ_WRITE callback does not
receive the IRP_MN_MDL paths. Instead the IRP_MJ_MDL_WRITE_COMPLETE would be
more relevant?

Best Wishes

“Rod Widdowson” wrote in message
> Have you checked for IRP_MN_MDL?

Yes, I have a mini-filter and I do receive IRP_MN_MDL. Infact I don’t receive any other IRP_MJ_WRITE for the same file. I may be doing something that could be causing it, but I am not sure and I am going to further investigate this.
As long as the experts in this forum confirm that the filter driver will receive the data eventually in the “PreWrite” with some minor code, I am fine, otherwise I’ll always be in a doubt whether I am doing something wrong or I am not looking at right place.