How to change the size of the file after filtering the IRP_MJ_READ

NTFSD
1

I developed a filter driver and provide filter functions for IRP_MJ_READ and IRP_MJ_QUERY_INFORMATION.
I found that when I open a test.txt with notepad.exe the filter driver works well, but when I open the same test.txt with wordpad.exe the size of the file can not be changed.
Besides, the values on the attribute page of test.txt(right-click and select attribute) can not be changed, aren’t these values was controled by IRP_MJ_QUERY_INFORMATION?

2

You don’t really provide enough information for anyone to help you, other
than to say that setting attributes is done using IRP_MJ_SET_INFORMATION and
FileBasicInformation. Adjusting file sizes is done using
IRP_MJ_SET_INFORMATION and FilePositionInformation/ FileEndOfFileInformation

Ged.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@serpurity.com
Sent: 04 June 2014 10:24
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to change the size of the file after filtering the
IRP_MJ_READ

I developed a filter driver and provide filter functions for IRP_MJ_READ and
IRP_MJ_QUERY_INFORMATION.
I found that when I open a test.txt with notepad.exe the filter driver works
well, but when I open the same test.txt with wordpad.exe the size of the
file can not be changed.
Besides, the values on the attribute page of test.txt(right-click and select
attribute) can not be changed, aren’t these values was controled by
IRP_MJ_QUERY_INFORMATION?

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

In fact, the filter driver’s target files have a feature that all of the target files have a Header in their content, the Header is 4KB long. The task of the filter driver is reading the content of the file without the Header, so the filter set the Parameters.Read.Offset to 4KB, and get the other real content. The result after filtering is right but with 4KB spaces at the last part of the content, just like the following:
this is the real content.[4KB spaces here]
I tried to cut the 4KB spaces by filtering IRP_MJ_QUERY_INFORMATION, this method works when the file was opened by notepad.exe, but failed when the file was opened by wordpad.exe.
So I guess may be the wordpad.exe read length from attribute of the target file? And how can I catch the IRP which is reading the attribute of the target file?

4

Not sure about wordpad but some applications use the directory
enumeration information as well. Depending on your design this can be
more difficult to determine which files within a given directory require
size changes.

Pete

On 6/4/2014 5:46 AM, xxxxx@serpurity.com wrote:

In fact, the filter driver’s target files have a feature that all of the target files have a Header in their content, the Header is 4KB long. The task of the filter driver is reading the content of the file without the Header, so the filter set the Parameters.Read.Offset to 4KB, and get the other real content. The result after filtering is right but with 4KB spaces at the last part of the content, just like the following:
this is the real content.[4KB spaces here]
I tried to cut the 4KB spaces by filtering IRP_MJ_QUERY_INFORMATION, this method works when the file was opened by notepad.exe, but failed when the file was opened by wordpad.exe.
So I guess may be the wordpad.exe read length from attribute of the target file? And how can I catch the IRP which is reading the attribute of the target file?

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

5

OK, we can now ignore the directory enumeration situation.
How can I change the file size in the attribute page of the file(right-click the file, select attribute), I have add filter post routine of IRP_MJ_QUERY_INFORMATION, it seems useless, the file size remains the origin one(I set the pFileStandardInfo->EndOfFile smaller in the post routine).

6

What I would recommend is to run FIleSpy and see what requests are
coming in for the file when you do this. I would not ignore the
directory enumeration, it may be getting the size by doing this. But
running FIleSpy will tell you which request it is.

Pete

On 6/4/2014 7:45 AM, xxxxx@serpurity.com wrote:

OK, we can now ignore the directory enumeration situation.
How can I change the file size in the attribute page of the file(right-click the file, select attribute), I have add filter post routine of IRP_MJ_QUERY_INFORMATION, it seems useless, the file size remains the origin one(I set the pFileStandardInfo->EndOfFile smaller in the post routine).

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

7

I have add a filter dispatch routine for IRP_MJ_DIRECTORY_CONTROL, that really work in the attribtue page of file, but the content of the file opened by wordpad.exe still remains 4KB spaces left…