Hello
I am building the IRP using IoBuildSynchronousFsdRequest API and sending it to lower tape class driver to write data into the File. But it is failing…
This happens only when i tried to write the data in NotePad or MsWord…
By going through the reference documents “The NT InsiderFinding File Contents in Memory_files” in OSR site…
The files which are opened through NotPead or MsWOrd will be memory mapped. So these file has only data Section but no cache section. this is the reason my IOCallDriver is failng how to handle this???
newIrp = IoBuildSynchronousFsdRequest(
IRP_MJ_WRITE,
FileDevice,
Buffer,
BufferLength,
&largeInt,
&Context->DeviceOperationComplete,
&ioStatus);
if (!newIrp) {
return STATUS_INSUFFICIENT_RESOURCES;
}
irpStack = IoGetNextIrpStackLocation(newIrp);
// newIrp->Tail.Overlay.OriginalFileObject = TapeRdWr->FileObject;
irpStack->FileObject = (PFILE_OBJECT)TapeRdWr->FileObject;
// irpStack->Parameters.Write.Key = (ULONG)TAPE_SIGNATURE;
newIrp->RequestorMode = KernelMode;
HSM_DbgPrint((" The irp flags %x org irp %x\n",newIrp->Flags,Irp->Flags));
// newIrp->Flags |= (IRP_WRITE_OPERATION|IRP_SYNCHRONOUS_API);
HSM_DbgPrint((" File Object Flag %x\n",irpStack->FileObject->Flags));
ry {
status = IoCallDriver(FileDevice,
newIrp);
if (status == STATUS_PENDING) {
KeWaitForSingleObject(&Context->DeviceOperationComplete,
Executive,
KernelMode,
FALSE,
NULL);
status = ioStatus.Status;
}
status = ioStatus.Status; // Sometimes IoCallDriver returns Immidiately wihout status pending
*Size = ioStatus.Information;
Regards
Poornima