I want to write some data after closing file

NTFSD
1

After a file closed,I want to write some data from 0 to FileLength in the
file.
I’m sure the IRP_MJ_CLEANUP(file closing) is for the last handle with write
accessing.
So,I can do it in two ways:
1.When the IRP_MJ_CLEANUP occurs,my filter can roll some IRP for writing my
data.But,if the handle is APPEND,not WRITE,I can’t write 0ffset 0 to
FileLength in the file.
2.When the IRP_MJ_CLEANUP occurs,my filter call the FileSystem to complete
it.And after it,I ZwCreateFile the file,and write my data,and ZwClose.
It can work in local FS.But in RDR,it can’t work.ZwCreateFile will fail,and
report STATUS_SHARING_VIOLATION.You can read it in these:
http://www.osronline.com/showThread.cfm?link=95589
http://www.osronline.com/showThread.cfm?link=95762
I know the oplocks,in my model,the first is execlusive oplock,and then it
should be broken(because I ZwCreateFile it).And the server should wait for
the client purge and write data.
But in my test,I can’t see it.Maybe there are some error in my test~~~

What shall I do?I just want to write some data after the file closing.
I think maybe I can do this work in other threads,example for system threads
or my application threads.But as you know,if I do this,I must Impersonate.

2

I decide to do it in my application thread.
The driver tell the application do something,and the application will do it.
we don’t afaid the secure problem,because my application is in the
session.So,the other application can open the remote file,my application can
open too.

“ecoresoft” дÈëÏûÏ¢ÐÂÎÅ:xxxxx@ntfsd…
> After a file closed,I want to write some data from 0 to FileLength in the
> file.
> I’m sure the IRP_MJ_CLEANUP(file closing) is for the last handle with
> write
> accessing.
> So,I can do it in two ways:
> 1.When the IRP_MJ_CLEANUP occurs,my filter can roll some IRP for writing
> my
> data.But,if the handle is APPEND,not WRITE,I can’t write 0ffset 0 to
> FileLength in the file.
> 2.When the IRP_MJ_CLEANUP occurs,my filter call the FileSystem to complete
> it.And after it,I ZwCreateFile the file,and write my data,and ZwClose.
> It can work in local FS.But in RDR,it can’t work.ZwCreateFile will
> fail,and
> report STATUS_SHARING_VIOLATION.You can read it in these:
> http://www.osronline.com/showThread.cfm?link=95589
> http://www.osronline.com/showThread.cfm?link=95762
> I know the oplocks,in my model,the first is execlusive oplock,and then it
> should be broken(because I ZwCreateFile it).And the server should wait for
> the client purge and write data.
> But in my test,I can’t see it.Maybe there are some error in my test~~~
>
> What shall I do?I just want to write some data after the file closing.
> I think maybe I can do this work in other threads,example for system
> threads
> or my application threads.But as you know,if I do this,I must Impersonate.
>
>
>
>
>

3

> 1.When the IRP_MJ_CLEANUP occurs,my filter can roll some IRP for writing

my
data.But,if the handle is APPEND,not WRITE,I can’t write 0ffset 0 to
FileLength in the file.

Try doing the paging write :slight_smile: and allocate the IRP via IoAllocateIrp and not
the more complex means.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com