Change file size (Sorry if I ask this question again.)

Slava_Imameyev · July 9, 2006, 11:48am

Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hello!

This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor.

My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set.

i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail.

~ganesh

Slava_Imameyev · July 10, 2006, 5:19am

Hi,
You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hello Slava,

Thanks for your input for the problem.

I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.

IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?

IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.

IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.

Afterwards I also deny fast i/o using the function.
FLT_IS_FASTIO_OPERATION.

This code works for Textpad editor.

~ganesh

PS: Have to create a new thread as i did not enable the mail feature.

-------------------------------------------------------------------
Slava Imameyev
xxxxx@fromru.com

Join Date: 17 Jun 2004
Posts To This List: 78
Re: Change file size (Sorry if I ask this question again.)
Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo

-------------------------------------------------------------------
ganesh pashupathi
xxxxx@rediffmail.com

Join Date: 09 Jul 2006
Posts To This List: 1
Change file size (Sorry if I ask this question again.)
Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –

Slava_Imameyev · July 10, 2006, 8:26am

The Cache Manager creates the section for a memory mapped file and this section is backed by the segment, this segment is also used for backing the sections for all applications’ memory mapping of this file. This segment can map the entire file including your header. If you skip your header for all Paging IO read requests( you must do this, else somebody will see your header ), the header will not be in the cache and will not be in any memory mapped file( actually they all share the same pages ). So when the modified page writer or cahe lazy writer will flush the modified pages( using Paging IO ) you must change offset. Your header is not in the cache, so you can’t read or write it using cached IO or mapped file.
You also must skip your header for all Non Paging IO, else applications can see your header instead of data.

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Thanks again.

I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.

My code in irp_mj_read is now like below.

Preread:
--------

//If my filter should consider this file…
//This is done using stream context to store file names…
if(MyFile)
{
Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
}

Postread:
----------
if(MyFile)
{
Do some processing.
}

Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?

~ganesh

On Mon, 10 Jul 2006 Slava Imameyev wrote :
>Hi,
> You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
>
>“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> Hello Slava,
>
> Thanks for your input for the problem.
>
> I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
>
> IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
>
> IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
>
> IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
>
> Afterwards I also deny fast i/o using the function.
> FLT_IS_FASTIO_OPERATION.
>
> This code works for Textpad editor.
>
> ~ganesh
>
> PS: Have to create a new thread as i did not enable the mail feature.
>
> -------------------------------------------------------------------
> Slava Imameyev
> xxxxx@fromru.com
>
> Join Date: 17 Jun 2004
> Posts To This List: 78
> Re: Change file size (Sorry if I ask this question again.)
> Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
>
> -------------------------------------------------------------------
> ganesh pashupathi
> xxxxx@rediffmail.com
>
> Join Date: 09 Jul 2006
> Posts To This List: 1
> Change file size (Sorry if I ask this question again.)
> Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 9:15am

When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.

Please help.

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Thanks again.
>
> I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
>
> My code in irp_mj_read is now like below.
>
> Preread:
> --------
>
> //If my filter should consider this file…
> //This is done using stream context to store file names…
> if(MyFile)
> {
> Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> }
>
> Postread:
> ----------
> if(MyFile)
> {
> Do some processing.
> }
>
> Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >Hi,
> > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> >
> >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hello Slava,
> >
> > Thanks for your input for the problem.
> >
> > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> >
> > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> >
> > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> >
> > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> >
> > Afterwards I also deny fast i/o using the function.
> > FLT_IS_FASTIO_OPERATION.
> >
> > This code works for Textpad editor.
> >
> > ~ganesh
> >
> > PS: Have to create a new thread as i did not enable the mail feature.
> >
> > -------------------------------------------------------------------
> > Slava Imameyev
> > xxxxx@fromru.com
> >
> > Join Date: 17 Jun 2004
> > Posts To This List: 78
> > Re: Change file size (Sorry if I ask this question again.)
> > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> >
> > -------------------------------------------------------------------
> > ganesh pashupathi
> > xxxxx@rediffmail.com
> >
> > Join Date: 09 Jul 2006
> > Posts To This List: 1
> > Change file size (Sorry if I ask this question again.)
> > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 9:43am

One of the problem of your design is the following

If the file has been cached and you skip your header while the cache was filled( i.e. processing Paging IO ), then you must not change the offset for all requests which will be processed by the Cache Manager, but you do not know which requests ( except the Paging and non cached requests ) only the FSD driver knows, and must change offset for all requests which will be sent directly to a disk driver, again only the FSD knows this if this is not Paging IO or non Cached request.
When you see a simple read request you do not know exactly whether it be proccessed by the Cache Manager or will be read directly from the disk.

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.

Please help.

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Thanks again.
>
> I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
>
> My code in irp_mj_read is now like below.
>
> Preread:
> --------
>
> //If my filter should consider this file…
> //This is done using stream context to store file names…
> if(MyFile)
> {
> Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> }
>
> Postread:
> ----------
> if(MyFile)
> {
> Do some processing.
> }
>
> Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >Hi,
> > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> >
> >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hello Slava,
> >
> > Thanks for your input for the problem.
> >
> > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> >
> > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> >
> > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> >
> > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> >
> > Afterwards I also deny fast i/o using the function.
> > FLT_IS_FASTIO_OPERATION.
> >
> > This code works for Textpad editor.
> >
> > ~ganesh
> >
> > PS: Have to create a new thread as i did not enable the mail feature.
> >
> > -------------------------------------------------------------------
> > Slava Imameyev
> > xxxxx@fromru.com
> >
> > Join Date: 17 Jun 2004
> > Posts To This List: 78
> > Re: Change file size (Sorry if I ask this question again.)
> > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> >
> > -------------------------------------------------------------------
> > ganesh pashupathi
> > xxxxx@rediffmail.com
> >
> > Join Date: 09 Jul 2006
> > Posts To This List: 1
> > Change file size (Sorry if I ask this question again.)
> > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 9:53am

I answered to your previous message. As I wrote I see a problem - “When you see a simple read request you do not know exactly whether it will be proccessed by the Cache Manager or will be read directly from the disk.”
Try to change all create request for your file to non cached, set FILE_NO_INTERMEDIATE_BUFFERING in Parameters.Create.Options->Options.
Then change offset for all requests.

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Thanks for your patience.

I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.

In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?

As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.

For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.

~ganesh

On Mon, 10 Jul 2006 Slava Imameyev wrote :
>When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> Hi Slava,
>
> I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
>
> Please help.
>
> ~ganesh
>
>
> On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> >Hi Slava,
> >
> > Thanks again.
> >
> > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> >
> > My code in irp_mj_read is now like below.
> >
> > Preread:
> > --------
> >
> > //If my filter should consider this file…
> > //This is done using stream context to store file names…
> > if(MyFile)
> > {
> > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > }
> >
> > Postread:
> > ----------
> > if(MyFile)
> > {
> > Do some processing.
> > }
> >
> > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> >
> >~ganesh
> >
> >
> >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > >Hi,
> > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > >
> > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > Hello Slava,
> > >
> > > Thanks for your input for the problem.
> > >
> > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > >
> > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > >
> > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > >
> > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > >
> > > Afterwards I also deny fast i/o using the function.
> > > FLT_IS_FASTIO_OPERATION.
> > >
> > > This code works for Textpad editor.
> > >
> > > ~ganesh
> > >
> > > PS: Have to create a new thread as i did not enable the mail feature.
> > >
> > > -------------------------------------------------------------------
> > > Slava Imameyev
> > > xxxxx@fromru.com
> > >
> > > Join Date: 17 Jun 2004
> > > Posts To This List: 78
> > > Re: Change file size (Sorry if I ask this question again.)
> > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > >
> > > -------------------------------------------------------------------
> > > ganesh pashupathi
> > > xxxxx@rediffmail.com
> > >
> > > Join Date: 09 Jul 2006
> > > Posts To This List: 1
> > > Change file size (Sorry if I ask this question again.)
> > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > >
> > >
> > >
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 10:00am

And you must set the FileObject->Flags |= FO_NO_INTERMEDIATE_BUFFERING, or instead changing the create request try to change all requests to IRP_NOCACHE.
“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
I answered to your previous message. As I wrote I see a problem - “When you see a simple read request you do not know exactly whether it will be proccessed by the Cache Manager or will be read directly from the disk.”
Try to change all create request for your file to non cached, set FILE_NO_INTERMEDIATE_BUFFERING in Parameters.Create.Options->Options.
Then change offset for all requests.

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Thanks for your patience.

I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.

In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?

As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.

For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.

~ganesh

On Mon, 10 Jul 2006 Slava Imameyev wrote :
>When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> Hi Slava,
>
> I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
>
> Please help.
>
> ~ganesh
>
>
> On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> >Hi Slava,
> >
> > Thanks again.
> >
> > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> >
> > My code in irp_mj_read is now like below.
> >
> > Preread:
> > --------
> >
> > //If my filter should consider this file…
> > //This is done using stream context to store file names…
> > if(MyFile)
> > {
> > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > }
> >
> > Postread:
> > ----------
> > if(MyFile)
> > {
> > Do some processing.
> > }
> >
> > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> >
> >~ganesh
> >
> >
> >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > >Hi,
> > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > >
> > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > Hello Slava,
> > >
> > > Thanks for your input for the problem.
> > >
> > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > >
> > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > >
> > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > >
> > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > >
> > > Afterwards I also deny fast i/o using the function.
> > > FLT_IS_FASTIO_OPERATION.
> > >
> > > This code works for Textpad editor.
> > >
> > > ~ganesh
> > >
> > > PS: Have to create a new thread as i did not enable the mail feature.
> > >
> > > -------------------------------------------------------------------
> > > Slava Imameyev
> > > xxxxx@fromru.com
> > >
> > > Join Date: 17 Jun 2004
> > > Posts To This List: 78
> > > Re: Change file size (Sorry if I ask this question again.)
> > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > >
> > > -------------------------------------------------------------------
> > > ganesh pashupathi
> > > xxxxx@rediffmail.com
> > >
> > > Join Date: 09 Jul 2006
> > > Posts To This List: 1
> > > Change file size (Sorry if I ask this question again.)
> > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > >
> > >
> > >
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 10:19am

Notepad uses memory mapped files, you changed offset only for Paging IO, accesing the memory mapped file generates the page faults, the page fault handler uses Paging IO request, so your solution worked for this applications.

“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

I tried this also. But still I see null charcters. The file is not present in cache as I flush the cache during the clean up and close irps (the flushing seems to be successfull).

Should this (the problem you suggest) not be a problem for textpad and notepad? The two editors work as expected in the read case.

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Thanks for your patience.
>
> I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.
>
> In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?
>
> As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.
>
> For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hi Slava,
> >
> > I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
> >
> > Please help.
> >
> > ~ganesh
> >
> >
> > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > >Hi Slava,
> > >
> > > Thanks again.
> > >
> > > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> > >
> > > My code in irp_mj_read is now like below.
> > >
> > > Preread:
> > > --------
> > >
> > > //If my filter should consider this file…
> > > //This is done using stream context to store file names…
> > > if(MyFile)
> > > {
> > > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > > }
> > >
> > > Postread:
> > > ----------
> > > if(MyFile)
> > > {
> > > Do some processing.
> > > }
> > >
> > > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> > >
> > >~ganesh
> > >
> > >
> > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > >Hi,
> > > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > > >
> > > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > Hello Slava,
> > > >
> > > > Thanks for your input for the problem.
> > > >
> > > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > > >
> > > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > > >
> > > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > > >
> > > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > > >
> > > > Afterwards I also deny fast i/o using the function.
> > > > FLT_IS_FASTIO_OPERATION.
> > > >
> > > > This code works for Textpad editor.
> > > >
> > > > ~ganesh
> > > >
> > > > PS: Have to create a new thread as i did not enable the mail feature.
> > > >
> > > > -------------------------------------------------------------------
> > > > Slava Imameyev
> > > > xxxxx@fromru.com
> > > >
> > > > Join Date: 17 Jun 2004
> > > > Posts To This List: 78
> > > > Re: Change file size (Sorry if I ask this question again.)
> > > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > > >
> > > > -------------------------------------------------------------------
> > > > ganesh pashupathi
> > > > xxxxx@rediffmail.com
> > > >
> > > > Join Date: 09 Jul 2006
> > > > Posts To This List: 1
> > > > Change file size (Sorry if I ask this question again.)
> > > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > > >
> > > >
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 2:40pm

Hi,
Rajeev Nagar’s book is the best source.
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Great!!! it works correctly now. I add the IRP_NOCACHE flag for every read request. Many many thanks to you.

Please suggest me some good documentation of this? I read documentation with the IFS kit and the very useful OSR archives. I also got a copy of Rajeev Nagar’s book today (i believe this is the start point).

~ganesh

On Mon, 10 Jul 2006 Slava Imameyev wrote :
>Notepad uses memory mapped files, you changed offset only for Paging IO, accesing the memory mapped file generates the page faults, the page fault handler uses Paging IO request, so your solution worked for this applications.
>
> “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> Hi Slava,
>
> I tried this also. But still I see null charcters. The file is not present in cache as I flush the cache during the clean up and close irps (the flushing seems to be successfull).
>
> Should this (the problem you suggest) not be a problem for textpad and notepad? The two editors work as expected in the read case.
>
> ~ganesh
>
>
> On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> >Hi Slava,
> >
> > Thanks for your patience.
> >
> > I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.
> >
> > In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?
> >
> > As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.
> >
> > For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.
> >
> >~ganesh
> >
> >
> >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > >When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> > > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > Hi Slava,
> > >
> > > I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
> > >
> > > Please help.
> > >
> > > ~ganesh
> > >
> > >
> > > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > > >Hi Slava,
> > > >
> > > > Thanks again.
> > > >
> > > > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> > > >
> > > > My code in irp_mj_read is now like below.
> > > >
> > > > Preread:
> > > > --------
> > > >
> > > > //If my filter should consider this file…
> > > > //This is done using stream context to store file names…
> > > > if(MyFile)
> > > > {
> > > > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > > > }
> > > >
> > > > Postread:
> > > > ----------
> > > > if(MyFile)
> > > > {
> > > > Do some processing.
> > > > }
> > > >
> > > > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> > > >
> > > >~ganesh
> > > >
> > > >
> > > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > > >Hi,
> > > > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > > > >
> > > > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > > Hello Slava,
> > > > >
> > > > > Thanks for your input for the problem.
> > > > >
> > > > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > > > >
> > > > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > > > >
> > > > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > > > >
> > > > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > > > >
> > > > > Afterwards I also deny fast i/o using the function.
> > > > > FLT_IS_FASTIO_OPERATION.
> > > > >
> > > > > This code works for Textpad editor.
> > > > >
> > > > > ~ganesh
> > > > >
> > > > > PS: Have to create a new thread as i did not enable the mail feature.
> > > > >
> > > > > -------------------------------------------------------------------
> > > > > Slava Imameyev
> > > > > xxxxx@fromru.com
> > > > >
> > > > > Join Date: 17 Jun 2004
> > > > > Posts To This List: 78
> > > > > Re: Change file size (Sorry if I ask this question again.)
> > > > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > > > >
> > > > > -------------------------------------------------------------------
> > > > > ganesh pashupathi
> > > > > xxxxx@rediffmail.com
> > > > >
> > > > > Join Date: 09 Jul 2006
> > > > > Posts To This List: 1
> > > > > Change file size (Sorry if I ask this question again.)
> > > > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >—
> > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > >
> > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >
> > >
> > >
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · July 10, 2006, 3:12pm

If you want to show to outside word that the file is smaller then it actually
is you need to make sure that results of read requests are consistent with
the your file size. It means that that if read request starts beyond your EOF
but before file system’s EOF you need to return STATUS_END_OF_FILE while file
system returns STATUS_SUCCESS. Also if read starts before your EOF and goes
beyond your EOF you need to change IoStatus.Information to reflect your EOF.
And make sure that FileObject->CurrentByteOffset is consistent with your
responses to read requests.

Alexei.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of ganesh pashupathi
Sent: Monday, July 10, 2006 12:00 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Re: Change file size (Sorry if I ask this question
again.)

Hello Slava,

Thanks for your input for the problem.

I use the FileSpy tool and find that the size is being change correctly for
FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me
know if I missed something here.

IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in
this case the irp flag value seen in FileSpy is 43). There is another read
that comes with flag value 900 (i.e. without no cache flag set). When should
the file start offset be changed?

IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.

IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and
FileStandardInformation. In case of FileStreamInformation the pointer
InfoBuffer is null.

Afterwards I also deny fast i/o using the function.
FLT_IS_FASTIO_OPERATION.

This code works for Textpad editor.

~ganesh

PS: Have to create a new thread as i did not enable the mail feature.

Slava Imameyev
xxxxx@fromru.com

Join Date: 17 Jun 2004
Posts To This List: 78
Re: Change file size (Sorry if I ask this question again.)
Do you change only IRPs? What about Fast IO requests. The
NtQueryInformationFile(…) uses
DriverObject->FastIoDispatch->FastIoQueryStandardInfo

ganesh pashupathi
xxxxx@rediffmail.com

Join Date: 09 Jul 2006
Posts To This List: 1
Change file size (Sorry if I ask this question again.)
Hello! This is my first time write of filter driver. I read various archives
on this site and found helpful. But I have a problem when a file is read
through wordpad editor. My driver insert a header in the file during file is
written onto the disk and the header is skipped when file is read from the
disk. According to my read in the archives, I have the header of size 1 page.
I change the file size in the irps and also skip the header in the read irp.
In case of wordpad the header is skipped but there are unexpected null
characters at the end of the data. The length equals the size of the file
without skipping the header. From where do wordpad read the file size? Just
as encrypt / decrypt is carried on in path where no chache flag is set where
should the file size changes be done. In file monitor tool I see that there
are two reads being called one from start offset 0 and another from start
offset 4096. I dont know why the second read comes. Both reads are one with
no cache bit set. i am sorry if i ask the same question again. But i am stuck
here and cannot find the correct archive mail. =0A ~ganesh –

http:ure-home.htm/xxxxx@Middle5?PARTNER=3> — Questions? First check the
IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently
subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send
a blank email to xxxxx@lists.osr.com</http:>

Slava_Imameyev · July 10, 2006, 3:32pm

Yes, and perform noncached I/O( FLTFL_IO_OPERATION_NON_CACHED ), in case of cached request the applications which map this file will see the header instead data when your request completes.
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Just one question. Can I access the header of the same file from the filter driver using the FltReadFile function?

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Great!!! it works correctly now. I add the IRP_NOCACHE flag for every read request. Many many thanks to you.
>
> Please suggest me some good documentation of this? I read documentation with the IFS kit and the very useful OSR archives. I also got a copy of Rajeev Nagar’s book today (i believe this is the start point).
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >Notepad uses memory mapped files, you changed offset only for Paging IO, accesing the memory mapped file generates the page faults, the page fault handler uses Paging IO request, so your solution worked for this applications.
> >
> > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hi Slava,
> >
> > I tried this also. But still I see null charcters. The file is not present in cache as I flush the cache during the clean up and close irps (the flushing seems to be successfull).
> >
> > Should this (the problem you suggest) not be a problem for textpad and notepad? The two editors work as expected in the read case.
> >
> > ~ganesh
> >
> >
> > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > >Hi Slava,
> > >
> > > Thanks for your patience.
> > >
> > > I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.
> > >
> > > In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?
> > >
> > > As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.
> > >
> > > For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.
> > >
> > >~ganesh
> > >
> > >
> > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > >When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> > > > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > Hi Slava,
> > > >
> > > > I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
> > > >
> > > > Please help.
> > > >
> > > > ~ganesh
> > > >
> > > >
> > > > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > > > >Hi Slava,
> > > > >
> > > > > Thanks again.
> > > > >
> > > > > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> > > > >
> > > > > My code in irp_mj_read is now like below.
> > > > >
> > > > > Preread:
> > > > > --------
> > > > >
> > > > > //If my filter should consider this file…
> > > > > //This is done using stream context to store file names…
> > > > > if(MyFile)
> > > > > {
> > > > > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > > > > }
> > > > >
> > > > > Postread:
> > > > > ----------
> > > > > if(MyFile)
> > > > > {
> > > > > Do some processing.
> > > > > }
> > > > >
> > > > > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> > > > >
> > > > >~ganesh
> > > > >
> > > > >
> > > > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > > > >Hi,
> > > > > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > > > > >
> > > > > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > > > Hello Slava,
> > > > > >
> > > > > > Thanks for your input for the problem.
> > > > > >
> > > > > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > > > > >
> > > > > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > > > > >
> > > > > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > > > > >
> > > > > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > > > > >
> > > > > > Afterwards I also deny fast i/o using the function.
> > > > > > FLT_IS_FASTIO_OPERATION.
> > > > > >
> > > > > > This code works for Textpad editor.
> > > > > >
> > > > > > ~ganesh
> > > > > >
> > > > > > PS: Have to create a new thread as i did not enable the mail feature.
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > Slava Imameyev
> > > > > > xxxxx@fromru.com
> > > > > >
> > > > > > Join Date: 17 Jun 2004
> > > > > > Posts To This List: 78
> > > > > > Re: Change file size (Sorry if I ask this question again.)
> > > > > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > ganesh pashupathi
> > > > > > xxxxx@rediffmail.com
> > > > > >
> > > > > > Join Date: 09 Jul 2006
> > > > > > Posts To This List: 1
> > > > > > Change file size (Sorry if I ask this question again.)
> > > > > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >—
> > > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > > >
> > > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > > >
> > > > >—
> > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > >
> > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 3:40pm

or ( in case of the cached request ) you read the file data instead of the header if some application has mapped this file( and the mapping has valid pages ) or if you process the recursive call from the cache manager as usual( i.e. skipping the header ).
So you can, but only using FLTFL_IO_OPERATION_NON_CACHED .
“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
Yes, and perform noncached I/O( FLTFL_IO_OPERATION_NON_CACHED ), in case of cached request the applications which map this file will see the header instead data when your request completes.
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Just one question. Can I access the header of the same file from the filter driver using the FltReadFile function?

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Great!!! it works correctly now. I add the IRP_NOCACHE flag for every read request. Many many thanks to you.
>
> Please suggest me some good documentation of this? I read documentation with the IFS kit and the very useful OSR archives. I also got a copy of Rajeev Nagar’s book today (i believe this is the start point).
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >Notepad uses memory mapped files, you changed offset only for Paging IO, accesing the memory mapped file generates the page faults, the page fault handler uses Paging IO request, so your solution worked for this applications.
> >
> > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hi Slava,
> >
> > I tried this also. But still I see null charcters. The file is not present in cache as I flush the cache during the clean up and close irps (the flushing seems to be successfull).
> >
> > Should this (the problem you suggest) not be a problem for textpad and notepad? The two editors work as expected in the read case.
> >
> > ~ganesh
> >
> >
> > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > >Hi Slava,
> > >
> > > Thanks for your patience.
> > >
> > > I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.
> > >
> > > In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?
> > >
> > > As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.
> > >
> > > For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.
> > >
> > >~ganesh
> > >
> > >
> > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > >When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> > > > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > Hi Slava,
> > > >
> > > > I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
> > > >
> > > > Please help.
> > > >
> > > > ~ganesh
> > > >
> > > >
> > > > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > > > >Hi Slava,
> > > > >
> > > > > Thanks again.
> > > > >
> > > > > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> > > > >
> > > > > My code in irp_mj_read is now like below.
> > > > >
> > > > > Preread:
> > > > > --------
> > > > >
> > > > > //If my filter should consider this file…
> > > > > //This is done using stream context to store file names…
> > > > > if(MyFile)
> > > > > {
> > > > > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > > > > }
> > > > >
> > > > > Postread:
> > > > > ----------
> > > > > if(MyFile)
> > > > > {
> > > > > Do some processing.
> > > > > }
> > > > >
> > > > > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> > > > >
> > > > >~ganesh
> > > > >
> > > > >
> > > > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > > > >Hi,
> > > > > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > > > > >
> > > > > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > > > Hello Slava,
> > > > > >
> > > > > > Thanks for your input for the problem.
> > > > > >
> > > > > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > > > > >
> > > > > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > > > > >
> > > > > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > > > > >
> > > > > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > > > > >
> > > > > > Afterwards I also deny fast i/o using the function.
> > > > > > FLT_IS_FASTIO_OPERATION.
> > > > > >
> > > > > > This code works for Textpad editor.
> > > > > >
> > > > > > ~ganesh
> > > > > >
> > > > > > PS: Have to create a new thread as i did not enable the mail feature.
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > Slava Imameyev
> > > > > > xxxxx@fromru.com
> > > > > >
> > > > > > Join Date: 17 Jun 2004
> > > > > > Posts To This List: 78
> > > > > > Re: Change file size (Sorry if I ask this question again.)
> > > > > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > ganesh pashupathi
> > > > > > xxxxx@rediffmail.com
> > > > > >
> > > > > > Join Date: 09 Jul 2006
> > > > > > Posts To This List: 1
> > > > > > Change file size (Sorry if I ask this question again.)
> > > > > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >—
> > > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > > >
> > > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > > >
> > > > >—
> > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > >
> > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · July 10, 2006, 3:55pm

Do not forget, for the IRP_NOCACHE requests the offset and size must be multiple of the volume’s sector size, so if you set this flag for every IRP, you must align buffers( you may modify IRP’s buffers and copy in the original buffer on completion, see SwapBuffers example ).

“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
or ( in case of the cached request ) you read the file data instead of the header if some application has mapped this file( and the mapping has valid pages ) or if you process the recursive call from the cache manager as usual( i.e. skipping the header ).
So you can, but only using FLTFL_IO_OPERATION_NON_CACHED .
“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
Yes, and perform noncached I/O( FLTFL_IO_OPERATION_NON_CACHED ), in case of cached request the applications which map this file will see the header instead data when your request completes.
“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
Hi Slava,

Just one question. Can I access the header of the same file from the filter driver using the FltReadFile function?

~ganesh

On Mon, 10 Jul 2006 ganesh pashupathi wrote :
>Hi Slava,
>
> Great!!! it works correctly now. I add the IRP_NOCACHE flag for every read request. Many many thanks to you.
>
> Please suggest me some good documentation of this? I read documentation with the IFS kit and the very useful OSR archives. I also got a copy of Rajeev Nagar’s book today (i believe this is the start point).
>
>~ganesh
>
>
>On Mon, 10 Jul 2006 Slava Imameyev wrote :
> >Notepad uses memory mapped files, you changed offset only for Paging IO, accesing the memory mapped file generates the page faults, the page fault handler uses Paging IO request, so your solution worked for this applications.
> >
> > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > Hi Slava,
> >
> > I tried this also. But still I see null charcters. The file is not present in cache as I flush the cache during the clean up and close irps (the flushing seems to be successfull).
> >
> > Should this (the problem you suggest) not be a problem for textpad and notepad? The two editors work as expected in the read case.
> >
> > ~ganesh
> >
> >
> > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > >Hi Slava,
> > >
> > > Thanks for your patience.
> > >
> > > I am implementing the read fucntionality of the filter driver. I manually create a plain text file with header of size 4096 followed by data. Now I have to show the data part in the worpad editor.
> > >
> > > In the read irp I check if the call is for my file (I store the file name in the create path using stream context.) If the call is for my file I just increment the start byte offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096 bytes (This is done for all types of read). Am I doing this rightly or this is what you are trying to say is wrong? Do you want some more information?
> > >
> > > As said before I also change the file size in irp_mj_query_information and irp_mj_directory_control.
> > >
> > > For time being I commented all the other IRPs like irp_mj_set_information and irp_mj_write to eliminate any interference of these.
> > >
> > >~ganesh
> > >
> > >
> > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > >When and how do you change the file? If you change the file using the cached IO and then application reads it using memory mapped file, it reads your header.
> > > > “ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > Hi Slava,
> > > >
> > > > I get confuse here. Now I change my read irp so that the start byte offset is changed for all types of reads. But still I see only the null characters in the file when opened by wordpad.
> > > >
> > > > Please help.
> > > >
> > > > ~ganesh
> > > >
> > > >
> > > > On Mon, 10 Jul 2006 ganesh pashupathi wrote :
> > > > >Hi Slava,
> > > > >
> > > > > Thanks again.
> > > > >
> > > > > I tried same, the first time I write the code but I could see only null characters in the file when wordpad opens the file. In this case the number of characters (though all null) is correct. After this I put the read related header skipping code inside the IRP_NO_CACHE condition (this is not correct) and now I could see the data but there were extra null characters appended.
> > > > >
> > > > > My code in irp_mj_read is now like below.
> > > > >
> > > > > Preread:
> > > > > --------
> > > > >
> > > > > //If my filter should consider this file…
> > > > > //This is done using stream context to store file names…
> > > > > if(MyFile)
> > > > > {
> > > > > Data->Iopb->Parameters.Read.ByteOffset += SIZE_OF_HEADER i.e. 4096;
> > > > > }
> > > > >
> > > > > Postread:
> > > > > ----------
> > > > > if(MyFile)
> > > > > {
> > > > > Do some processing.
> > > > > }
> > > > >
> > > > > Is there something else that I not take into account in case of read? Is there any other place that needs changes to the file size?
> > > > >
> > > > >~ganesh
> > > > >
> > > > >
> > > > >On Mon, 10 Jul 2006 Slava Imameyev wrote :
> > > > > >Hi,
> > > > > > You must change the offset for all IRP_MJ_READ and IRP_MJ_WRITE requests, i.e. new_offset = size_of_your_header + original_offset .
> > > > > >
> > > > > >“ganesh pashupathi” wrote in message news:xxxxx@ntfsd…
> > > > > > Hello Slava,
> > > > > >
> > > > > > Thanks for your input for the problem.
> > > > > >
> > > > > > I use the FileSpy tool and find that the size is being change correctly for FastIoQueryStandardInfo. Below I give the pseudo code that I write. Let me know if I missed something here.
> > > > > >
> > > > > > IRP_MJ_READ - I modify the start offset only when NO_CACHE bit is set. (in this case the irp flag value seen in FileSpy is 43). There is another read that comes with flag value 900 (i.e. without no cache flag set). When should the file start offset be changed?
> > > > > >
> > > > > > IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY - change file size.
> > > > > >
> > > > > > IRP_MJ_QUERY_INFORMATION - change file size for FileAllInformation and FileStandardInformation. In case of FileStreamInformation the pointer InfoBuffer is null.
> > > > > >
> > > > > > Afterwards I also deny fast i/o using the function.
> > > > > > FLT_IS_FASTIO_OPERATION.
> > > > > >
> > > > > > This code works for Textpad editor.
> > > > > >
> > > > > > ~ganesh
> > > > > >
> > > > > > PS: Have to create a new thread as i did not enable the mail feature.
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > Slava Imameyev
> > > > > > xxxxx@fromru.com
> > > > > >
> > > > > > Join Date: 17 Jun 2004
> > > > > > Posts To This List: 78
> > > > > > Re: Change file size (Sorry if I ask this question again.)
> > > > > > Do you change only IRPs? What about Fast IO requests. The NtQueryInformationFile(…) uses DriverObject->FastIoDispatch->FastIoQueryStandardInfo
> > > > > >
> > > > > > -------------------------------------------------------------------
> > > > > > ganesh pashupathi
> > > > > > xxxxx@rediffmail.com
> > > > > >
> > > > > > Join Date: 09 Jul 2006
> > > > > > Posts To This List: 1
> > > > > > Change file size (Sorry if I ask this question again.)
> > > > > > Hello! This is my first time write of filter driver. I read various archives on this site and found helpful. But I have a problem when a file is read through wordpad editor. My driver insert a header in the file during file is written onto the disk and the header is skipped when file is read from the disk. According to my read in the archives, I have the header of size 1 page. I change the file size in the irps and also skip the header in the read irp. In case of wordpad the header is skipped but there are unexpected null characters at the end of the data. The length equals the size of the file without skipping the header. From where do wordpad read the file size? Just as encrypt / decrypt is carried on in path where no chache flag is set where should the file size changes be done. In file monitor tool I see that there are two reads being called one from start offset 0 and another from start offset 4096. I dont know why the second read comes. Both reads are one with no cache bit set. i am sorry if i ask the same question again. But i am stuck here and cannot find the correct archive mail. =0A ~ganesh –
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >—
> > > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > > >
> > > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > > >
> > > > >—
> > > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > > >
> > > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >—
> > >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · July 10, 2006, 4:40pm

Writer wrote writing written wrtings…

Any chance the list can address the issue of endless Re: Re: Re: of
a Re:? This thread ahd almost 10… more data in title than some give in
the text body

–
Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

OSR_Community_User · July 10, 2006, 10:08pm

> In the read irp I check if the call is for my file (I store the file name
in the create

path using stream context.) If the call is for my file I just increment the
start byte
offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by 4096

Do this for IRP_NONCACHED_IO only.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

OSR_Community_User · July 10, 2006, 10:17pm

> Just one question. Can I access the header of the same file from the filter

driver using the FltReadFile function?

Invent some FSCTL code for such operation.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Slava_Imameyev · July 11, 2006, 1:56am

This will not work if FSD skips the cache for some files or requests and
reads from the disk. Only the FSD decides how to process simple( i.e. w/o
IRP_NOCAHE or IRP_PAGING flags ) requests. For example some sort of FSD over
FSD filters which does not use the cache for some files.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
>> In the read irp I check if the call is for my file (I store the file
>> name
> in the create
>>path using stream context.) If the call is for my file I just increment
>>the
> start byte
>>offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by
>>4096
>
> Do this for IRP_NONCACHED_IO only.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>

OSR_Community_User · July 11, 2006, 9:01am

There are two simple examples of what I believe Slava is suggesting to
consider:

(1) NTFS stores files inline (the $DATA attribute is “resident” in the
MFT record) in which case the paging I/O writes are against the MFT, not
against the file itself.

(2) RDBSS-based mini-redirectors change their caching policy internally
without notification to filters. Thus, what appears to be a cached I/O
can be converted to a non-cached I/O by the underlying FSD.

(1) can be avoided by ensuring the file is too big to fit in the MFT
record (and a 4KB header will do that, since the largest MFT records in
the history of NTFS thus far were 4KB.)

(2) is a challenge because it means you have to understand internal
state of the FCB and the underlying FSD. This is dangerous as anyone
who has done this with W2K can attest - the data structures change in
service packs and security rollups and hot fixes without notice.

The approach we’ve taken (and that I’ve advocated for years) is to build
a layered file system - in that way you control the cache and don’t care
if the underlying FSD decides to do something different. It’s a more
complicated “up front” implementation with fewer long-term complications
(because you minimize dependence on the underlying FSD behavior.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
Sent: Tuesday, July 11, 2006 2:12 AM
To: ntfsd redirect
Subject: Re:[ntfsd] Re:Re: Re:Re: Change file size (Sorry if I ask this
question again.)

This will not work if FSD skips the cache for some files or requests and

reads from the disk. Only the FSD decides how to process simple( i.e.
w/o
IRP_NOCAHE or IRP_PAGING flags ) requests. For example some sort of FSD
over
FSD filters which does not use the cache for some files.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
>> In the read irp I check if the call is for my file (I store the
file
>> name
> in the create
>>path using stream context.) If the call is for my file I just
increment
>>the
> start byte
>>offset parameter of the read Data->Iopb->Parameters.Read.ByteOffset by

>>4096
>
> Do this for IRP_NONCACHED_IO only.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · July 12, 2006, 4:09pm

> May be this is a silly question. But is it recommend that we look for the

FileObject->CurrentByteOffset field? In the IFS kit documentation it says
‘Undocumented fields within a file object should be considered inaccessible.’

I think it is documented in the IFS kit samples.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com