behavior of the echo command from cmd

NTFSD
1

Hi, guys!

I want to ask you why when I use “echo “1234” > C:\1234.txt” in dos box I didn’t receive IRP_MJ_CLOSE after IRP_MJ_CLEANUP, but only on the next echo ( exactly the same ) IRP_MJ_CLOSE for previous FILE_OBJECT arrived and than IRP_MJ_CREATE for new one?
You can see that in the OSR’s FileSpy too.

TIA
Arkady

2

The IRP_MJ_CLOSE arrives when the VM system releases its reference on the file object. You of course left out all the bits in the middle that tell us what is happening, but my guess is that the file is being opened for overwrite. This causes the file to be truncated, which means Cc and Mm don’t care about caching anything for it anymore, so you then see the close arrive. Hmm. You do say that the close arrives BEFORE the new create, but that suggests there is another operation that causes the cache purge.

Tony
OSR

3

Tnx, Tony!
There's no my bits but of two echo commands. Now I understand that overwrite of the second echo cause such behavior ( first echo lines: 1-5 , second : 6- 10 )
Arkady

Time sent Dur. Process Thread ID DeviceObject Type IRP Request IRP Flags TopLvlIrp FileObject FsContext FsContext2 FO Flags Sop Path Status More info

1 09:20:14.343 0 cmd.exe 552 854C5AB0 IRP 86936E00 IRP_MJ_CREATE 40000884 00000000 856ADC38 E366F0D0 E366F218 00000002 00000000 C:\1234.TXT STATUS_SUCCESS FILE_OVERWRITE_IF CreOpts: 00000060 Access: 00120196 Share: 00000001 Attrib: 00000080 Result: FILE_CREATED
2 09:20:14.343 0 cmd.exe 552 854C5AB0 IRP 8696AE00 IRP_MJ_WRITE 40000A00 00000000 856ADC38 E366F0D0 E366F218 00040042 85B88D8C C:\1234.TXT STATUS_SUCCESS Offset 00000000-00000000 ToWrite 9 Written: 9
3 09:20:14.343 0 cmd.exe 552 854C5AB0 IRP 86E92E00 IRP_MJ_CLEANUP 40000404 00000000 856ADC38 E366F0D0 E366F218 00043042 85B88D8C C:\1234.TXT STATUS_SUCCESS
4 09:20:16.156 0 System 44 854C5AB0 IRP 86FE8E00 IRP_MJ_WRITE 40000043 00000002 856ADC38 E366F0D0 E366F218 00044042 85B88D8C C:\1234.TXT STATUS_SUCCESS Offset 00000000-00000000 ToWrite 1000 Written: 9
5 09:20:16.156 0 System 44 854C5AB0 IRP 86E24E00 IRP_MJ_SET_INFORMATION 40000042 00000000 856ADC38 E366F0D0 E366F218 00044042 85B88D8C C:\1234.TXT STATUS_SUCCESS FileEndOfFileInformation EndOfFile: 00000000-00000009
6 09:20:28.515 0 cmd.exe 552 854C5AB0 IRP 8699EE00 IRP_MJ_CREATE 40000884 00000000 85A041D0 E366F0D0 E355BDF0 00000002 00000000 C:\1234.TXT STATUS_SUCCESS FILE_OVERWRITE_IF CreOpts: 00000060 Access: 00120196 Share: 00000001 Attrib: 00000080 Result: FILE_OVERWRITTEN
7 09:20:28.515 0 System 44 854C5AB0 IRP 86A38E00 IRP_MJ_CLOSE 40000404 00000000 856ADC38 E366F0D0 E366F218 00044042 85B88D8C C:\1234.TXT STATUS_SUCCESS
8 09:20:28.515 0 cmd.exe 552 854C5AB0 IRP 86B50E00 IRP_MJ_WRITE 40000A00 00000000 85A041D0 E366F0D0 E355BDF0 00040042 85B88D8C C:\1234.TXT STATUS_SUCCESS Offset 00000000-00000000 ToWrite 9 Written: 9
9 09:20:28.515 0 cmd.exe 552 854C5AB0 IRP 86AA8E00 IRP_MJ_CLEANUP 40000404 00000000 85A041D0 E366F0D0 E355BDF0 00043042 85B88D8C C:\1234.TXT STATUS_SUCCESS
10 09:20:28.515 0 cmd.exe 552 854C5AB0 IRP 86DCAE00 IRP_MJ_CLOSE 40000404 00000000 85A041D0 E366F0D0 E355BDF0 00044042 85B88D8C C:\1234.TXT STATUS_SUCCESS