Hi all!
My FS filter driver inspects the files content in Create and ReadWrite
routines.
I used ZwCreateFile (with FILE_NO_INTERMEDIATE_BUFFERING flag). “?:” prefix
was added to the file name and this prefix
was removed in my Create routine and Irp was forwarded to the next device.
Then ZwReadFile was called on the
file handle received from ZwCreateFile.
I have replaced ZwCreateFile by IoCreateFileSpecifyDeviceObjectHint and the
read Irp is built now using IoBuildSynchronousFsdRequest.
It changed the driver’s behavior. If a small file (less than 256K) is copied
form disk on key to the hard disk, the filter driver doesn’t see any
Read Irp. It seems that my internal read fetches data to the cache. I had
the same problem with ZwCreateFile, but FILE_NO_INTERMEDIATE_BUFFERING
flag solved the problem.
Any idea?
Thanks,
Dani