How to tell if a file was memory mapped?

NTFSD
1

I need to know if a file object has had any memory mapped handles to it
(CreateFileMapping, MapViewOfFile, etc) when I receive the IRP_MJ_CLEANUP. I
looked at using MmCanFileBeTruncated, but when the memory handle is closed
before the file handle, MmCanFileBeTruncated returns TRUE. What I want to
know is if it *ever* had a memory mapped handle created. Does such a thing
exist?

Thanks in advance for any help,
Jesse

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

> I need to know if a file object has had any memory mapped handles to it

(CreateFileMapping, MapViewOfFile, etc) when I receive the IRP_MJ_CLEANUP.
I

FSRTL_FLAG_USER_MAPPED_FILE in FSRTL_COMMON_FCB_HEADER::Flags.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com