mapped file, IRP_MN_MDL

NTFSD
1

Hi,

I swear when I opened a text file before using notepad I saw an
IRP_MN_MDL read. Now I am not, I am just seeing an IRP_PAGING_IO from
the memory manager. The new stack looks like such:

ChildEBP RetAddr Args to Child

…
01 ba425c08 8081df33 8081e4ed ba425c2c 8081e4ed nt!IovCallDriver+0x112
(FPO: [Non-Fpo])
02 ba425c14 8081e4ed 825b2db0 82745428 c0005780 nt!IofCallDriver+0x13
(FPO: [Non-Fpo])
03 ba425c2c 8085114a 8265ac02 82745460 82745440 nt!IoPageRead+0x109
(FPO: [Non-Fpo])
04 ba425cc8 8085eff8 00000000 00af0000 82745428 nt!MiDispatchFault+0xece
(FPO: [Non-Fpo])
05 ba425d4c 8088c798 00000000 00af0000 00000001 nt!MmAccessFault+0xe30
(FPO: [Non-Fpo])
06 ba425d4c 010052df 00000000 00af0000 00000001 nt!KiTrap0E+0xdc (FPO:
[0,0] TrapFrame @ ba425d64)
…

Since this file has never been opened before, I thought I should get an
IRP_MN_MDL…? Am I crazy?

Thanks!
-Jeff

2

IRP_MN_MDL is only issued by Lanman and not for all portions of the file. (i.e.
when we copy a file from/to a VM, I see IRP_MN_MDL for some, but not all portions of
the file).

xxxxx@emc.com wrote:

Hi,

I swear when I opened a text file before using notepad I saw an
IRP_MN_MDL read. Now I am not, I am just seeing an IRP_PAGING_IO from
the memory manager. The new stack looks like such:

ChildEBP RetAddr Args to Child

…
> …
>
> Since this file has never been opened before, I thought I should get an
> IRP_MN_MDL…? Am I crazy?

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

3

Ahhh that’s probably why I saw it sometimes, I am working in a VM, ok.
Good to know I wasn’t completely
crazy, just mostly.

Thanks!
-Jeff

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Wednesday, May 02, 2007 5:22 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] mapped file, IRP_MN_MDL

IRP_MN_MDL is only issued by Lanman and not for all portions of the
file. (i.e.
when we copy a file from/to a VM, I see IRP_MN_MDL for some, but not all
portions of
the file).

xxxxx@emc.com wrote:

Hi,

I swear when I opened a text file before using notepad I saw an
IRP_MN_MDL read. Now I am not, I am just seeing an IRP_PAGING_IO from
the memory manager. The new stack looks like such:

ChildEBP RetAddr Args to Child

…
> …
>
> Since this file has never been opened before, I thought I should get
an
> IRP_MN_MDL…? Am I crazy?

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@emc.com
To unsubscribe send a blank email to xxxxx@lists.osr.com