Hi all,
I want to make a copy of a file before it is going to be changed. Now
i am planning to do it in this method . Intercepting all the
IRP_MJ_CREATE with write access flag & allocating new IRP_MJ_WRITE for
the target device object in a different location.
If c:\test.txt get IRP_MJ_CREATE with
IrpSp->Parameters.Create.SecurityContext->DesiredAccess &
FILE_WRITE_DATA …
Allocating new IRP_MJ_WRITE with target location d:\backup\test.txt
But my doubt is this will work for PAGING_IO only ,
what i have to do for DIRECT_IO & memory mapped files ?
Do i need to provide some support for FastIo ?
or else
Should i handle it as filtering all IRP_MJ_WRITE rather than IRP_MJ_CREATE ?
Thanks,
SivaRaja