How could I get the new content of a special file as soon as it is written.

NTFSD
1

I want to get the new content of a special file,when someone write to
it.The new content means what the man just write in.
I’m a jackaroo about driver developement.The following is some thinking
of mine about the question.

I want to write a file driver to deal with it.I have seen a filemon’s
source code.But I couldn’t sure I can get the being written content from the
IRP_MJ_WRITE request.I didn’t know how the operationg system manage the
file.Could I do like this?And how to do?

Any help will be appreciate!

Thanks.

2

Thank for your answer!
But I can’t find the IRP_SET_INFORMATION request from the DDK help and the
neweset IFS help.Could you tell me how to use it?

Thanks again!

“Jiang Hua” wrote in message news:xxxxx@ntfsd…

you can hook the IRP_SET_INFORMATION
GET the file content from Irp->UserBuffer
------------
FROM ice-sword