File Copy & paste doubt

NTDEV
1

Hi All,
I have hooked on to the ZwWriteFile() system service. I am
interested in touching the buffer that contains the Write data, before
calling the routine write service. When I perform a copy & paste for a .txt
file the system crashes. However it works fine if I open a file with note
pad and type some data and save it.

Can anybody throw some light on this.

Thanks in advance.
regards,
shivas
**************************************************************************
This email (including any attachments) is intended for the sole use of the
intended recipient/s and may contain material that is CONFIDENTIAL AND
PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or
distribution or forwarding of any or all of the contents in this message is
STRICTLY PROHIBITED. If you are not the intended recipient, please contact
the sender by email and delete all copies; your cooperation in this regard
is appreciated.
**************************************************************************

2

Notepad uses memory-mapping, which means that you’ll never see a
ZwWriteFile for any file modifications that it makes. You’ll have to
develop a filesystem filter driver and watch for paging I/Os.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shiva_Shankar
Sent: Friday, September 06, 2002 5:12 AM
To: NT Developers Interest List
Subject: [ntdev] File Copy & paste doubt

Hi All,
I have hooked on to the ZwWriteFile() system service. I
am interested in touching the buffer that contains the Write
data, before calling the routine write service. When I
perform a copy & paste for a .txt file the system crashes.
However it works fine if I open a file with note pad and type
some data and save it.

Can anybody throw some light on this.

Thanks in advance.
regards,
shivas
**************************************************************
************
This email (including any attachments) is intended for the
sole use of the intended recipient/s and may contain material
that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any
review or reliance by others or copying or distribution or
forwarding of any or all of the contents in this message is
STRICTLY PROHIBITED. If you are not the intended recipient,
please contact the sender by email and delete all copies;
your cooperation in this regard is appreciated.
**************************************************************
************

You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%