Files that reside only in memory

NTFSD
1

Hi all,

I would like to create files that reside only in memory using a filter
driver.

The idea is to create a memory mapped file when my filter receives a
IRP_MJ_CREATE.
I wonder if I can use che handle created by *ZwCreateSection* as it were a
file object.

My guess is it does not work, because at least in user mode you cannot do
read/write on the handle
returned by the function CreateFileMapping.

I see two other solutions. As first option, I could write a simple file
system driver that
maintain files in memory; it sounds complex and long.
Second, I could filter all the IRP_MJ_… so that read and write work on a
memory buffer and
other operations return something meaningful.

Perhaps another option is to create a virtual volume in memory and to
redirect the IRP_MJ_CREATE
to it.

Any brilliant idea?

Thanks, Francesco

–
Francesco Garelli, Ph.D.

2

francesco garelli wrote:

Hi all,

I would like to create files that reside only in memory using a filter
driver.

The idea is to create a memory mapped file when my filter receives a
IRP_MJ_CREATE.
I wonder if I can use che handle created by *ZwCreateSection* as it were
a file object.

My guess is it does not work, because at least in user mode you cannot
do read/write on the handle
returned by the function CreateFileMapping.

I see two other solutions. As first option, I could write a simple file
system driver that
maintain files in memory; it sounds complex and long.
Second, I could filter all the IRP_MJ_… so that read and write work on
a memory buffer and
other operations return something meaningful.

Perhaps another option is to create a virtual volume in memory and to
redirect the IRP_MJ_CREATE
to it.

Any brilliant idea?

Well a (dirty) way to do it would be to filter all read/write access to
your file and divert them to a buffer in non-paged pool. There must be a
better way.

–

Edouard

3

ramdisk?

“francesco garelli” wrote in message
news:xxxxx@ntfsd…

Hi all,

I would like to create files that reside only in memory using a filter
driver.

The idea is to create a memory mapped file when my filter receives a
IRP_MJ_CREATE.
I wonder if I can use che handle created by ZwCreateSection as it were a
file object.

My guess is it does not work, because at least in user mode you cannot do
read/write on the handle
returned by the function CreateFileMapping.

I see two other solutions. As first option, I could write a simple file
system driver that
maintain files in memory; it sounds complex and long.
Second, I could filter all the IRP_MJ_… so that read and write work on a
memory buffer and
other operations return something meaningful.

Perhaps another option is to create a virtual volume in memory and to
redirect the IRP_MJ_CREATE
to it.

Any brilliant idea?

Thanks, Francesco

–
Francesco Garelli, Ph.D.