Difference between IRP_MJ_READ and IRP_MJ_READ*

NTFSD
1

Hi ,

I am using the FileMon utiltity to check the IRP’s generated for different IO operations
I have considered the following file sizes for a set of .bmp files
1kb,255kb,256kb and 2MB

Now when I do a copy paste operation for the above file sizes ,ideally the IRP_MJ_READ request would also be generated in addition to the create and query IRP’s .
But when I copy paste files of size lesser than 256KB ,I see the IRP_MJ_READ* being generated.

What is the difference between the two IRP’s,as I could not find the equivalent #define value for the IRP_MJ_READ* _in wdm.h header file ?

Any help is greately appreciated

Regards,
Seema

2

I don’t use this tool, but could it be FASTIO?
wrote in message news:xxxxx@ntfsd…
> Hi ,
>
> I am using the FileMon utiltity to check the IRP’s generated for different
> IO operations
> I have considered the following file sizes for a set of .bmp files
> 1kb,255kb,256kb and 2MB
>
> Now when I do a copy paste operation for the above file sizes ,ideally the
> IRP_MJ_READ request would also be generated in addition to the create and
> query IRP’s .
> But when I copy paste files of size lesser than 256KB ,I see the
> IRP_MJ_READ* being generated.
>
> What is the difference between the two IRP’s,as I could not find the
> equivalent #define value for the IRP_MJ_READ* _in wdm.h header file ?
>
> Any help is greately appreciated
>
> Regards,
> Seema
>

3

IIRC the * signals paging i/o.

wrote in message news:xxxxx@ntfsd…
> Hi ,
>
> I am using the FileMon utiltity to check the IRP’s generated for different
> IO operations
> I have considered the following file sizes for a set of .bmp files
> 1kb,255kb,256kb and 2MB
>
> Now when I do a copy paste operation for the above file sizes ,ideally the
> IRP_MJ_READ request would also be generated in addition to the create and
> query IRP’s .
> But when I copy paste files of size lesser than 256KB ,I see the
> IRP_MJ_READ* being generated.
>
> What is the difference between the two IRP’s,as I could not find the
> equivalent #define value for the IRP_MJ_READ* _in wdm.h header file ?
>
> Any help is greately appreciated
>
> Regards,
> Seema
>

4

to be able to get some concrete answer, compare the IRPs of filemon with filespy(or as a better thought use filespy ;-)), doing this will make you understand the way filemon displays information.

Thanks
Aditya

5

Thanks for all the help.
I will check the IRP’s with the Filespy

Regards,
Seema