How to get really size for write when paging IO pre write?

NTFSD
1

Hi All！I want to change all data for paging IO write,but I find just a few data was changed,because data->iostatu.information is not length of pre write. how can I get really size when pre write?help me！thanks !

2

or how can I change data of post write?

3

I have a filter that looks at write lengths in pre-write. I haven't seen any issues with these parameters, even in the paging IO path.

File offset: CallbackData->Iopb->Parameters.Write.ByteOffset.QuadPart
Write length: CallbackData->Iopb->Parameters.Write.Length

4

For example, I use notepad.exe to write 3 bytes, but when intercepting pagination IO, I find callback Data ->Iopb ->Parameters.Write. The Length is always a multiple of the sector alignment value of the volume, but the actual length written to the disk is 3, which always prevents me from obtaining the actual written value during pre write

5

实际上，我想在预写入时用AES加密数据，但由于这个原因，我发现实际写入的数据不完整，正如我提到的，只写入了3个字节

6

Yup that's expected. Paging writes are non extending

7

thanks!Rod. You are right.Do you know how the operating system reaches the actual write length?I am curious why the operating system can accurately determine the length of the data, rather than writing the length of the pre Write routine

8

Its all done in the file system. If it sees a paging write it knows not to overwrite.

For instance here's FAT

1 Like
9

thanks!Rod. It is usefully

10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.