FS Filter Driver READ request

NTFSD
1

Hi All,

I am writing an upper filter driver. I run hello.exe which displays “Hello World” using only printf statement. In the read completion request of the filter driver I capture all READ requests for hello.exe.

But filter driver never gets READ request for the offset range containing “Hello World” string within the hello.exe. And all the data which is read never contains this string. Still I can see output as “Hello World”. I can see rest of the hello.exe being read. Is there any specific reason why it happens so?

Any help would be appreciated.

Thanks,

rushikesh.

Do you Yahoo!?
Get better spam protection with Yahoo! Mail

2

Um, you mean the read request for the “Hello world” within the hello.exe ?
You will never see such request. If you run the EXE, the whole image will
be mapped into memory. No additional reads/writes for hello.exe will occur
unless the file is paged out and paged in again. In the case of such small
EXE, this will probably never happen.

L.
----- Original Message -----
From: rushikesh patil
To: Windows File Systems Devs Interest List
Sent: Monday, March 01, 2004 11:22 PM
Subject: [ntfsd] FS Filter Driver READ request

Hi All,

I am writing an upper filter driver. I run hello.exe which displays “Hello World” using only printf statement. In the read completion request of the filter driver I capture all READ requests for hello.exe.

But filter driver never gets READ request for the offset range containing “Hello World” string within the hello.exe. And all the data which is read never contains this string. Still I can see output as “Hello World”. I can see rest of the hello.exe being read. Is there any specific reason why it happens so?

Any help would be appreciated.

Thanks,

rushikesh.

Do you Yahoo!?
Get better spam protection with Yahoo! Mail — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@volny.cz To unsubscribe send a blank email to xxxxx@lists.osr.com