I have two files fileA and fileB. The fileA with size of zero points to the
fileB. When a CREATE request for fileA comes, the filter lets the base NTFS
file system complete the request and then updates its file size to the size
of fileB by calling FltSetInformationFile before the CREATE request returns
to the end user. I confirmed that both allocation size and file size in the
file object (FCB pointed to by FsContext) are changed after
FltSetInformationFile returns.
Then the filter will copy fileB to fileA when a READ request comes.
This mechanism works for all programs except Notepad. Notepad always shows a
blank text file directly without issuing a READ request. If I write some
characters to fileA during the CREATE request, Notepad shows those
characters and other garbage without READ request too.
So what is wrong with this design?
Regards,
Shangwu