How to change data in irp->userbuffer

NTFSD
1

hi all
Now i want to change the data in irp->userbuffer during the IRP_MJ_READ.
In my IRP_MJ_READ dispatch i set a completion routine and set an event. so i
can come back to my IRP_MJ_READ dispatch after the lower-driver finish the
read operation.
at that time i check the parameters and change the buffer like the following
code

if(irpSp->DeviceObject->Flags&DO_BUFFERED_IO)
{
//not do anything now

}
else if(irpSp->DeviceObject->Flags&DO_DIRECT_IO)
{
//not do anything now

}
else
{
if(NT_SUCCESS(Irp->IoStatus.Status)&&(NULL!=Irp->UserBuffer))
{
try
{
ProbeForRead(Irp->UserBuffer, irpSp->Parameters.Read.Length,
DeviceObject->AlignmentRequirement);
*(char *)Irp->UserBuffer=‘A’;
*((char *)Irp->UserBuffer+1)=‘A’;
*((char *)Irp->UserBuffer+2)=‘A’;
*((char *)Irp->UserBuffer+3)=‘A’;
}except (EXCEPTION_EXECUTE_HANDLER)
{
status = Irp->IoStatus.Status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
}
}
}
status = Irp->IoStatus.Status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );

return status;

During my debug, i saw the buffer data was changed to “AAAA”, but finally
the application also display the original data.
(I use the notepad to open a txt file)
some days before i ask the question and get some help.
I look for the user guide of the DDK about memory management and others, but
still can do it well,
could anybody tell me something?
thanxs

–
yours Sean

2

Hello,

I’m surprised that you didn’t say you get a blue screen using that code.
You are doing multiple IRP completion.
The UserBuffer filed in the IRP is valid only in the context of the
calling process. You overwrote the memory of some arbitrary process.
You should use either BUFFERED_IO or DIRECT_IO.

Andrei

sean liu wrote:

hi all

Now i want to change the data in irp->userbuffer during the IRP_MJ_READ.
In my IRP_MJ_READ dispatch i set a completion routine and set an
event. so i can come back to my IRP_MJ_READ dispatch after the
lower-driver finish the read operation.
at that time i check the parameters and change the buffer like the
following code

if(irpSp->DeviceObject->Flags&DO_BUFFERED_IO)
{
//not do anything now

}
else if(irpSp->DeviceObject->Flags&DO_DIRECT_IO)
{
//not do anything now

}
else
{
if(NT_SUCCESS(Irp->IoStatus.Status)&&(NULL!=Irp->UserBuffer))
{
try
{
ProbeForRead(Irp->UserBuffer, irpSp->Parameters.Read.Length ,
DeviceObject->AlignmentRequirement);
*(char *)Irp->UserBuffer=‘A’;
*((char *)Irp->UserBuffer+1)=‘A’;
*((char *)Irp->UserBuffer+2)=‘A’;
*((char *)Irp->UserBuffer+3)=‘A’;
}except (EXCEPTION_EXECUTE_HANDLER)
{
status = Irp->IoStatus.Status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
}
}
}
status = Irp->IoStatus.Status ;
IoCompleteRequest( Irp, IO_NO_INCREMENT );

return status;

During my debug, i saw the buffer data was changed to “AAAA”, but
finally the application also display the original data.

(I use the notepad to open a txt file)
some days before i ask the question and get some help.
I look for the user guide of the DDK about memory management and
others, but still can do it well,
could anybody tell me something?

thanxs

–
yours Sean
— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently
subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To
unsubscribe send a blank email to xxxxx@lists.osr.com

–
Ignorance more frequently begets confidence than does knowledge.
— Charles Darwin

–
This message was scanned for spam and viruses by BitDefender.
For more information please visit http://linux.bitdefender.com/

3

Hi Andrei
thanks for your help.
i have read the document, that say there are 3 kind of I/O
buffered, direct, neither
every time when i debuged, after use notepad to open a txt file, it seemed
will went to
“neither”. After finished read operation and back to my read dispatcher, i
saw the buffer block discribed in Irp->UserBuffer is filled what the txt
file really have.
when i look into the document “Using Neither Buffered Nor Direct I/O” in
msdn, that doesn’t mean i can change the buffer directly?
Did you mean when i create the device , i should set its flag to
DO_BUFFERED_IO or DO_DIRECT_IO?
i tryed it, but it cause a crash, maybe i set some device it should not be
set?

On 5/20/05, Andrei Zlate-Podani wrote:
>
> Hello,
>
> I’m surprised that you didn’t say you get a blue screen using that code.
> You are doing multiple IRP completion.
> The UserBuffer filed in the IRP is valid only in the context of the
> calling process. You overwrote the memory of some arbitrary process.
> You should use either BUFFERED_IO or DIRECT_IO.
>
> Andrei
>
>
>
> sean liu wrote:
>
> > hi all
> >
> > Now i want to change the data in irp->userbuffer during the IRP_MJ_READ.
> > In my IRP_MJ_READ dispatch i set a completion routine and set an
> > event. so i can come back to my IRP_MJ_READ dispatch after the
> > lower-driver finish the read operation.
> > at that time i check the parameters and change the buffer like the
> > following code
> >
> > if(irpSp->DeviceObject->Flags&DO_BUFFERED_IO)
> > {
> > //not do anything now
> >
> > }
> > else if(irpSp->DeviceObject->Flags&DO_DIRECT_IO)
> > {
> > //not do anything now
> >
> > }
> > else
> > {
> > if(NT_SUCCESS(Irp->IoStatus.Status)&&(NULL!=Irp->UserBuffer))
> > {
> > try
> > {
> > ProbeForRead(Irp->UserBuffer, irpSp->Parameters.Read.Length ,
> > DeviceObject->AlignmentRequirement);
> > *(char *)Irp->UserBuffer=‘A’;
> > *((char *)Irp->UserBuffer+1)=‘A’;
> > *((char *)Irp->UserBuffer+2)=‘A’;
> > *((char *)Irp->UserBuffer+3)=‘A’;
> > }except (EXCEPTION_EXECUTE_HANDLER)
> > {
> > status = Irp->IoStatus.Status;
> > IoCompleteRequest( Irp, IO_NO_INCREMENT );
> > }
> > }
> > }
> > status = Irp->IoStatus.Status ;
> > IoCompleteRequest( Irp, IO_NO_INCREMENT );
> >
> > return status;
> >
> >
> > During my debug, i saw the buffer data was changed to “AAAA”, but
> > finally the application also display the original data.
> >
> > (I use the notepad to open a txt file)
> > some days before i ask the question and get some help.
> > I look for the user guide of the DDK about memory management and
> > others, but still can do it well,
> > could anybody tell me something?
> >
> > thanxs
> >
> > –
> > yours Sean
> > — Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17 You are currently
> > subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >------------------------------------------------------------------------
> >
> >
> >
> >
>
>
> –
> Ignorance more frequently begets confidence than does knowledge.
> — Charles Darwin
>
>
>
> –
> This message was scanned for spam and viruses by BitDefender.
> For more information please visit http://linux.bitdefender.com/
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
yours Sean