Memory mapped file problem

NTFSD
1

Hi,
I face strange problem on memory mapped file. I am using Win XP Prof SP2
as my test machine. I write a usermode application to open the file using
‘fopen’, then call ‘fread’ 3 bytes from the offset = 2 at the beginning of
the file. Note that I didn’t memory mapped the file (encrypted).

I notice the application the read request does not generate paging io read
even though the the file is not in the Cache Manager. Further analysis I
notice the file is already memory mapped in create completion routine.

In Create completion routine, CcIsFileCache return FALSE => not in Cache.
FileObject->SectionObjectPointer->DataSectionObject is not NULL => may be
memory mapped by application.
MmCanFileBeTruncated return TRUE.
PFSRTL_COMMON_FCB_HEADER flag has FSRTL_FLAG_USER_MAPPED_FILE => memory
mapped by app

The strange thing is the OS is freshly reboot and I execute the above
usermode read routine, I didn’t see any paging IO read for this file. Since
I hook on Paging IO read only for decryption of content, the read return
garbage.

Can someone help to explain the possible reason?

Thanks for any suggestion!

Regards,

Sin Lam

2

Section was created and view to the section was mapped and then possibly
unmapped, but none of the pages of the mapped view was touched by an
application, which maps the view, therefore page faults was not issued.

“Tan Sin Lam” wrote in message news:xxxxx@ntfsd…
> Hi,
> I face strange problem on memory mapped file. I am using Win XP Prof SP2
> as my test machine. I write a usermode application to open the file using
> ‘fopen’, then call ‘fread’ 3 bytes from the offset = 2 at the beginning of
> the file. Note that I didn’t memory mapped the file (encrypted).
>
> I notice the application the read request does not generate paging io
> read even though the the file is not in the Cache Manager. Further
> analysis I notice the file is already memory mapped in create completion
> routine.
>
> In Create completion routine, CcIsFileCache return FALSE => not in Cache.
> FileObject->SectionObjectPointer->DataSectionObject is not NULL => may be
> memory mapped by application.
> MmCanFileBeTruncated return TRUE.
> PFSRTL_COMMON_FCB_HEADER flag has FSRTL_FLAG_USER_MAPPED_FILE => memory
> mapped by app
>
> The strange thing is the OS is freshly reboot and I execute the above
> usermode read routine, I didn’t see any paging IO read for this file.
> Since I hook on Paging IO read only for decryption of content, the read
> return garbage.
>
> Can someone help to explain the possible reason?
>
> Thanks for any suggestion!
>
> Regards,
>
> Sin Lam
>
>
>