Memory Mapped files to read

Lokanadham_Rallapalli · September 8, 2006, 3:11am

Hello Guru,

When a program like notepad, uses Memory Mapped files to read content from a
file, our mini filter should intercept those calls and then change the
contents in memory that are received by notepad. Is it possible yes/no if
yes, then how?

Thanks & Regards,
Lokanadham R

OSR_Community_User · September 8, 2006, 3:37am

You must track all IRP_MJ_READ requests and perform decryption only if one
of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set
in Irp->Flags. It means that you’ll receive decrypted memory and encrypted
data on disk. If you do so you have no need to care about memory mapped
files.

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

Lokanadham_Rallapalli · September 8, 2006, 4:25am

Thanks for reply…

i’m not reciving IRP_MJ_READ requests first itself…

please help me…

regards,
Lokanadham R

On 9/8/06, Gunko Andrey wrote:
>
> You must track all IRP_MJ_READ requests and perform decryption only if one
> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set
> in Irp->Flags. It means that you’ll receive decrypted memory and encrypted
> data on disk. If you do so you have no need to care about memory mapped
> files.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |Sent: Friday, September 08, 2006 10:12 AM
> |To: Windows File Systems Devs Interest List
> |Subject: [ntfsd] Memory Mapped files to read
> |
> |Hello Guru,
> |
> |When a program like notepad, uses Memory Mapped files to read content
> from
> |a
> |file, our mini filter should intercept those calls and then change the
> |contents in memory that are received by notepad. Is it possible yes/no if
> |yes, then how?
> |
> |Thanks & Regards,
> |Lokanadham R
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Lokanadham R
Mobile:+91 9818476626

OSR_Community_User · September 8, 2006, 4:43am

Did you receive any other IRP_MJ_READ requests? How you implemented it? How
do you know that you are not receiving that requests? If you use
IrpSp->FileObject->FileName to determine the file name it is not right to do
this in Read handler. You can only do this on Create and add the name and
FileObject into you internal buffer to compare it later in IRP_MJ_READ.

Andrey Gunko

soft Xpansion GmbH & Co.KG

Programmer

Powered by eKnow-how

Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [http: www.maus-soft.com]

_____

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lokanadham R
Sent: Friday, September 08, 2006 11:25 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Memory Mapped files to read

Thanks for reply…

i’m not reciving IRP_MJ_READ requests first itself…

please help me…

regards,

Lokanadham R

On 9/8/06, Gunko Andrey wrote:

You must track all IRP_MJ_READ requests and perform decryption only if one
of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set
in Irp->Flags. It means that you’ll receive decrypted memory and encrypted
data on disk. If you do so you have no need to care about memory mapped
files.

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261561-
|xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|Sent: Friday, September 08, 2006 10:12 AM
|To: Windows File Systems Devs Interest List
|Subject: [ntfsd] Memory Mapped files to read
|
|Hello Guru,
|
|When a program like notepad, uses Memory Mapped files to read content from
|a
|file, our mini filter should intercept those calls and then change the
|contents in memory that are received by notepad. Is it possible yes/no if
|yes, then how?
|
|Thanks & Regards,
|Lokanadham R
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Lokanadham R
Mobile:+91 9818476626 — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: xxxxx@maus.donetsk.ua To unsubscribe send a blank email to
xxxxx@lists.osr.com</http:>

Slava_Imameyev · September 8, 2006, 5:02am

> You must track all IRP_MJ_READ requests and perform decryption only if one

of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set

It is wrong to perform encryption/decryption in a filter using this
technique.
One can do this only if one sure- the underlying FSD always uses the Cache
or only memory mapped files are used by the FSD’s clients ( i.e.
applications and the system ).

–
Slava Imameyev, xxxxx@hotmail.com

“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> You must track all IRP_MJ_READ requests and perform decryption only if one
> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set
> in Irp->Flags. It means that you’ll receive decrypted memory and encrypted
> data on disk. If you do so you have no need to care about memory mapped
> files.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |Sent: Friday, September 08, 2006 10:12 AM
> |To: Windows File Systems Devs Interest List
> |Subject: [ntfsd] Memory Mapped files to read
> |
> |Hello Guru,
> |
> |When a program like notepad, uses Memory Mapped files to read content
> from
> |a
> |file, our mini filter should intercept those calls and then change the
> |contents in memory that are received by notepad. Is it possible yes/no if
> |yes, then how?
> |
> |Thanks & Regards,
> |Lokanadham R
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

OSR_Community_User · September 8, 2006, 5:17am

You are about file operations without cache? But for those operations
IRP_NOCACHE flag will set. It’s not wrong.

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261576-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 12:02 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|> You must track all IRP_MJ_READ requests and perform decryption only if
|one
|> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
|set
|
|It is wrong to perform encryption/decryption in a filter using this
|technique.
|One can do this only if one sure- the underlying FSD always uses the Cache
|or only memory mapped files are used by the FSD’s clients ( i.e.
|applications and the system ).
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> You must track all IRP_MJ_READ requests and perform decryption only if
|one
|> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
|set
|> in Irp->Flags. It means that you’ll receive decrypted memory and
|encrypted
|> data on disk. If you do so you have no need to care about memory mapped
|> files.
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
|> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |Sent: Friday, September 08, 2006 10:12 AM
|> |To: Windows File Systems Devs Interest List
|> |Subject: [ntfsd] Memory Mapped files to read
|> |
|> |Hello Guru,
|> |
|> |When a program like notepad, uses Memory Mapped files to read content
|> from
|> |a
|> |file, our mini filter should intercept those calls and then change the
|> |contents in memory that are received by notepad. Is it possible yes/no
|if
|> |yes, then how?
|> |
|> |Thanks & Regards,
|> |Lokanadham R
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · September 8, 2006, 5:20am

> i’m not reciving IRP_MJ_READ requests first itself…

Of course you do, but you do it much sooner than you observe it.
Delete prefetch cache, reboot PC and try with FIleSpy.

L.

Slava_Imameyev · September 8, 2006, 5:25am

> You are about file operations without cache? But for those operations

IRP_NOCACHE flag will set. It’s not wrong.

No. I wrote about the design of the FSD.

There are 3 types of requests

Paging
NonCached
Other( simple user’s app read/write ).

FSD may use the Cache Manager for the third type but may skip it for some
requests.

–
Slava Imameyev, xxxxx@hotmail.com

“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> You are about file operations without cache? But for those operations
> IRP_NOCACHE flag will set. It’s not wrong.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |Sent: Friday, September 08, 2006 12:02 PM
> |To: Windows File Systems Devs Interest List
> |Subject: Re:[ntfsd] Memory Mapped files to read
> |
> |> You must track all IRP_MJ_READ requests and perform decryption only if
> |one
> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
> |set
> |
> |It is wrong to perform encryption/decryption in a filter using this
> |technique.
> |One can do this only if one sure- the underlying FSD always uses the
> Cache
> |or only memory mapped files are used by the FSD’s clients ( i.e.
> |applications and the system ).
> |
> |–
> | Slava Imameyev, xxxxx@hotmail.com
> |
> |
> |“Gunko Andrey” wrote in message
> news:xxxxx@ntfsd…
> |> You must track all IRP_MJ_READ requests and perform decryption only if
> |one
> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
> |set
> |> in Irp->Flags. It means that you’ll receive decrypted memory and
> |encrypted
> |> data on disk. If you do so you have no need to care about memory mapped
> |> files.
> |>
> |> Andrey Gunko
> |> soft Xpansion GmbH & Co.KG
> |> Programmer
> |> Powered by eKnow-how
> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> 234
> |> 2984172 Internet: [www.maus-soft.com]
> |>
> |>
> |> |-----Original Message-----
> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |> |Sent: Friday, September 08, 2006 10:12 AM
> |> |To: Windows File Systems Devs Interest List
> |> |Subject: [ntfsd] Memory Mapped files to read
> |> |
> |> |Hello Guru,
> |> |
> |> |When a program like notepad, uses Memory Mapped files to read content
> |> from
> |> |a
> |> |file, our mini filter should intercept those calls and then change the
> |> |contents in memory that are received by notepad. Is it possible yes/no
> |if
> |> |yes, then how?
> |> |
> |> |Thanks & Regards,
> |> |Lokanadham R
> |> |
> |> |
> |> |—
> |> |Questions? First check the IFS FAQ at
> |> |https://www.osronline.com/article.cfm?id=17
> |> |
> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |To unsubscribe send a blank email to xxxxx@lists.osr.com
> |>
> |>
> |
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

OSR_Community_User · September 8, 2006, 5:53am

But I’m not clear what is wrong with technique I wrote? Would you explain
me?

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261587-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 12:25 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|> You are about file operations without cache? But for those operations
|> IRP_NOCACHE flag will set. It’s not wrong.
|
|No. I wrote about the design of the FSD.
|
|There are 3 types of requests
|- Paging
|- NonCached
|- Other( simple user’s app read/write ).
|
| FSD may use the Cache Manager for the third type but may skip it for some
|requests.
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> You are about file operations without cache? But for those operations
|> IRP_NOCACHE flag will set. It’s not wrong.
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
|> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |Sent: Friday, September 08, 2006 12:02 PM
|> |To: Windows File Systems Devs Interest List
|> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |
|> |> You must track all IRP_MJ_READ requests and perform decryption only if
|> |one
|> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
|> |set
|> |
|> |It is wrong to perform encryption/decryption in a filter using this
|> |technique.
|> |One can do this only if one sure- the underlying FSD always uses the
|> Cache
|> |or only memory mapped files are used by the FSD’s clients ( i.e.
|> |applications and the system ).
|> |
|> |–
|> | Slava Imameyev, xxxxx@hotmail.com
|> |
|> |
|> |“Gunko Andrey” wrote in message
|> news:xxxxx@ntfsd…
|> |> You must track all IRP_MJ_READ requests and perform decryption only if
|> |one
|> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags
|> |set
|> |> in Irp->Flags. It means that you’ll receive decrypted memory and
|> |encrypted
|> |> data on disk. If you do so you have no need to care about memory
|mapped
|> |> files.
|> |>
|> |> Andrey Gunko
|> |> soft Xpansion GmbH & Co.KG
|> |> Programmer
|> |> Powered by eKnow-how
|> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
|> 234
|> |> 2984172 Internet: [www.maus-soft.com]
|> |>
|> |>
|> |> |-----Original Message-----
|> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
|> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |> |Sent: Friday, September 08, 2006 10:12 AM
|> |> |To: Windows File Systems Devs Interest List
|> |> |Subject: [ntfsd] Memory Mapped files to read
|> |> |
|> |> |Hello Guru,
|> |> |
|> |> |When a program like notepad, uses Memory Mapped files to read content
|> |> from
|> |> |a
|> |> |file, our mini filter should intercept those calls and then change
|the
|> |> |contents in memory that are received by notepad. Is it possible
|yes/no
|> |if
|> |> |yes, then how?
|> |> |
|> |> |Thanks & Regards,
|> |> |Lokanadham R
|> |> |
|> |> |
|> |> |—
|> |> |Questions? First check the IFS FAQ at
|> |> |https://www.osronline.com/article.cfm?id=17
|> |> |
|> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |To unsubscribe send a blank email to leave-261561-
|xxxxx@lists.osr.com
|> |>
|> |>
|> |
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · September 8, 2006, 6:09am

>Would you explain me?

Imagine an FSD which does the following:

Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
Calls MmFlushImageSection, then CcFlushCache, then CcPurgeCacheSection
that return success codes( this means- no user’s maps exist for this data
stream )
Read data directly from a disk without using the Cache.

–
Slava Imameyev, xxxxx@hotmail.com

“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> But I’m not clear what is wrong with technique I wrote? Would you explain
> me?
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |Sent: Friday, September 08, 2006 12:25 PM
> |To: Windows File Systems Devs Interest List
> |Subject: Re:[ntfsd] Memory Mapped files to read
> |
> |> You are about file operations without cache? But for those operations
> |> IRP_NOCACHE flag will set. It’s not wrong.
> |
> |No. I wrote about the design of the FSD.
> |
> |There are 3 types of requests
> |- Paging
> |- NonCached
> |- Other( simple user’s app read/write ).
> |
> | FSD may use the Cache Manager for the third type but may skip it for
> some
> |requests.
> |
> |–
> | Slava Imameyev, xxxxx@hotmail.com
> |
> |
> |“Gunko Andrey” wrote in message
> news:xxxxx@ntfsd…
> |> You are about file operations without cache? But for those operations
> |> IRP_NOCACHE flag will set. It’s not wrong.
> |>
> |> Andrey Gunko
> |> soft Xpansion GmbH & Co.KG
> |> Programmer
> |> Powered by eKnow-how
> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> 234
> |> 2984172 Internet: [www.maus-soft.com]
> |>
> |>
> |> |-----Original Message-----
> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |Sent: Friday, September 08, 2006 12:02 PM
> |> |To: Windows File Systems Devs Interest List
> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |
> |> |> You must track all IRP_MJ_READ requests and perform decryption only
> if
> |> |one
> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
> flags
> |> |set
> |> |
> |> |It is wrong to perform encryption/decryption in a filter using this
> |> |technique.
> |> |One can do this only if one sure- the underlying FSD always uses the
> |> Cache
> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
> |> |applications and the system ).
> |> |
> |> |–
> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |
> |> |
> |> |“Gunko Andrey” wrote in message
> |> news:xxxxx@ntfsd…
> |> |> You must track all IRP_MJ_READ requests and perform decryption only
> if
> |> |one
> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
> flags
> |> |set
> |> |> in Irp->Flags. It means that you’ll receive decrypted memory and
> |> |encrypted
> |> |> data on disk. If you do so you have no need to care about memory
> |mapped
> |> |> files.
> |> |>
> |> |> Andrey Gunko
> |> |> soft Xpansion GmbH & Co.KG
> |> |> Programmer
> |> |> Powered by eKnow-how
> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> |> 234
> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |>
> |> |>
> |> |> |-----Original Message-----
> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |> |> |Sent: Friday, September 08, 2006 10:12 AM
> |> |> |To: Windows File Systems Devs Interest List
> |> |> |Subject: [ntfsd] Memory Mapped files to read
> |> |> |
> |> |> |Hello Guru,
> |> |> |
> |> |> |When a program like notepad, uses Memory Mapped files to read
> content
> |> |> from
> |> |> |a
> |> |> |file, our mini filter should intercept those calls and then change
> |the
> |> |> |contents in memory that are received by notepad. Is it possible
> |yes/no
> |> |if
> |> |> |yes, then how?
> |> |> |
> |> |> |Thanks & Regards,
> |> |> |Lokanadham R
> |> |> |
> |> |> |
> |> |> |—
> |> |> |Questions? First check the IFS FAQ at
> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |
> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |To unsubscribe send a blank email to leave-261561-
> |xxxxx@lists.osr.com
> |> |>
> |> |>
> |> |
> |> |
> |> |
> |> |—
> |> |Questions? First check the IFS FAQ at
> |> |https://www.osronline.com/article.cfm?id=17
> |> |
> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |To unsubscribe send a blank email to xxxxx@lists.osr.com
> |>
> |>
> |
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

OSR_Community_User · September 8, 2006, 6:28am

|Imagine an FSD which does the following:
|
|- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
|- Calls MmFlushImageSection, then CcFlushCache, then CcPurgeCacheSection
|that return success codes( this means- no user’s maps exist for this data
|stream )
|- Read data directly from a disk without using the Cache.

I think for third IRP_NOCACHE will set, or it doesn’t?

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261592-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 1:09 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|>Would you explain me?
|
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> But I’m not clear what is wrong with technique I wrote? Would you explain
|> me?
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
|> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |Sent: Friday, September 08, 2006 12:25 PM
|> |To: Windows File Systems Devs Interest List
|> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |
|> |> You are about file operations without cache? But for those operations
|> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |
|> |No. I wrote about the design of the FSD.
|> |
|> |There are 3 types of requests
|> |- Paging
|> |- NonCached
|> |- Other( simple user’s app read/write ).
|> |
|> | FSD may use the Cache Manager for the third type but may skip it for
|> some
|> |requests.
|> |
|> |–
|> | Slava Imameyev, xxxxx@hotmail.com
|> |
|> |
|> |“Gunko Andrey” wrote in message
|> news:xxxxx@ntfsd…
|> |> You are about file operations without cache? But for those operations
|> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |>
|> |> Andrey Gunko
|> |> soft Xpansion GmbH & Co.KG
|> |> Programmer
|> |> Powered by eKnow-how
|> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
|> 234
|> |> 2984172 Internet: [www.maus-soft.com]
|> |>
|> |>
|> |> |-----Original Message-----
|> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
|> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |Sent: Friday, September 08, 2006 12:02 PM
|> |> |To: Windows File Systems Devs Interest List
|> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |
|> |> |> You must track all IRP_MJ_READ requests and perform decryption only
|> if
|> |> |one
|> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
|> flags
|> |> |set
|> |> |
|> |> |It is wrong to perform encryption/decryption in a filter using this
|> |> |technique.
|> |> |One can do this only if one sure- the underlying FSD always uses the
|> |> Cache
|> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
|> |> |applications and the system ).
|> |> |
|> |> |–
|> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |
|> |> |
|> |> |“Gunko Andrey” wrote in message
|> |> news:xxxxx@ntfsd…
|> |> |> You must track all IRP_MJ_READ requests and perform decryption only
|> if
|> |> |one
|> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
|> flags
|> |> |set
|> |> |> in Irp->Flags. It means that you’ll receive decrypted memory and
|> |> |encrypted
|> |> |> data on disk. If you do so you have no need to care about memory
|> |mapped
|> |> |> files.
|> |> |>
|> |> |> Andrey Gunko
|> |> |> soft Xpansion GmbH & Co.KG
|> |> |> Programmer
|> |> |> Powered by eKnow-how
|> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
|+49
|> |> 234
|> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |>
|> |> |>
|> |> |> |-----Original Message-----
|> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
|> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |> |> |Sent: Friday, September 08, 2006 10:12 AM
|> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |Subject: [ntfsd] Memory Mapped files to read
|> |> |> |
|> |> |> |Hello Guru,
|> |> |> |
|> |> |> |When a program like notepad, uses Memory Mapped files to read
|> content
|> |> |> from
|> |> |> |a
|> |> |> |file, our mini filter should intercept those calls and then change
|> |the
|> |> |> |contents in memory that are received by notepad. Is it possible
|> |yes/no
|> |> |if
|> |> |> |yes, then how?
|> |> |> |
|> |> |> |Thanks & Regards,
|> |> |> |Lokanadham R
|> |> |> |
|> |> |> |
|> |> |> |—
|> |> |> |Questions? First check the IFS FAQ at
|> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |
|> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |> |To unsubscribe send a blank email to leave-261561-
|> |xxxxx@lists.osr.com
|> |> |>
|> |> |>
|> |> |
|> |> |
|> |> |
|> |> |—
|> |> |Questions? First check the IFS FAQ at
|> |> |https://www.osronline.com/article.cfm?id=17
|> |> |
|> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |To unsubscribe send a blank email to leave-261576-
|xxxxx@lists.osr.com
|> |>
|> |>
|> |
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · September 8, 2006, 6:42am

> I think for third IRP_NOCACHE will set, or it doesn’t?

No. This is an FSD decision to flush cache, purge pages and read from a
disk.
I wrote - “without IRP_NOCACHE”!

–
Slava Imameyev, xxxxx@hotmail.com

“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> |Imagine an FSD which does the following:
> |
> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
> |- Calls MmFlushImageSection, then CcFlushCache, then CcPurgeCacheSection
> |that return success codes( this means- no user’s maps exist for this data
> |stream )
> |- Read data directly from a disk without using the Cache.
>
> I think for third IRP_NOCACHE will set, or it doesn’t?
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |Sent: Friday, September 08, 2006 1:09 PM
> |To: Windows File Systems Devs Interest List
> |Subject: Re:[ntfsd] Memory Mapped files to read
> |
> |>Would you explain me?
> |
> |
> |–
> | Slava Imameyev, xxxxx@hotmail.com
> |
> |
> |“Gunko Andrey” wrote in message
> news:xxxxx@ntfsd…
> |> But I’m not clear what is wrong with technique I wrote? Would you
> explain
> |> me?
> |>
> |> Andrey Gunko
> |> soft Xpansion GmbH & Co.KG
> |> Programmer
> |> Powered by eKnow-how
> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> 234
> |> 2984172 Internet: [www.maus-soft.com]
> |>
> |>
> |> |-----Original Message-----
> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |Sent: Friday, September 08, 2006 12:25 PM
> |> |To: Windows File Systems Devs Interest List
> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |
> |> |> You are about file operations without cache? But for those
> operations
> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |
> |> |No. I wrote about the design of the FSD.
> |> |
> |> |There are 3 types of requests
> |> |- Paging
> |> |- NonCached
> |> |- Other( simple user’s app read/write ).
> |> |
> |> | FSD may use the Cache Manager for the third type but may skip it for
> |> some
> |> |requests.
> |> |
> |> |–
> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |
> |> |
> |> |“Gunko Andrey” wrote in message
> |> news:xxxxx@ntfsd…
> |> |> You are about file operations without cache? But for those
> operations
> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |>
> |> |> Andrey Gunko
> |> |> soft Xpansion GmbH & Co.KG
> |> |> Programmer
> |> |> Powered by eKnow-how
> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> |> 234
> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |>
> |> |>
> |> |> |-----Original Message-----
> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |> |Sent: Friday, September 08, 2006 12:02 PM
> |> |> |To: Windows File Systems Devs Interest List
> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |> |
> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> only
> |> if
> |> |> |one
> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
> |> flags
> |> |> |set
> |> |> |
> |> |> |It is wrong to perform encryption/decryption in a filter using this
> |> |> |technique.
> |> |> |One can do this only if one sure- the underlying FSD always uses
> the
> |> |> Cache
> |> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
> |> |> |applications and the system ).
> |> |> |
> |> |> |–
> |> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |> |
> |> |> |
> |> |> |“Gunko Andrey” wrote in message
> |> |> news:xxxxx@ntfsd…
> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> only
> |> if
> |> |> |one
> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
> |> flags
> |> |> |set
> |> |> |> in Irp->Flags. It means that you’ll receive decrypted memory and
> |> |> |encrypted
> |> |> |> data on disk. If you do so you have no need to care about memory
> |> |mapped
> |> |> |> files.
> |> |> |>
> |> |> |> Andrey Gunko
> |> |> |> soft Xpansion GmbH & Co.KG
> |> |> |> Programmer
> |> |> |> Powered by eKnow-how
> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
> |+49
> |> |> 234
> |> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |> |>
> |> |> |>
> |> |> |> |-----Original Message-----
> |> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
> |> |> |> |To: Windows File Systems Devs Interest List
> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
> |> |> |> |
> |> |> |> |Hello Guru,
> |> |> |> |
> |> |> |> |When a program like notepad, uses Memory Mapped files to read
> |> content
> |> |> |> from
> |> |> |> |a
> |> |> |> |file, our mini filter should intercept those calls and then
> change
> |> |the
> |> |> |> |contents in memory that are received by notepad. Is it possible
> |> |yes/no
> |> |> |if
> |> |> |> |yes, then how?
> |> |> |> |
> |> |> |> |Thanks & Regards,
> |> |> |> |Lokanadham R
> |> |> |> |
> |> |> |> |
> |> |> |> |—
> |> |> |> |Questions? First check the IFS FAQ at
> |> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |> |
> |> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |> |To unsubscribe send a blank email to leave-261561-
> |> |xxxxx@lists.osr.com
> |> |> |>
> |> |> |>
> |> |> |
> |> |> |
> |> |> |
> |> |> |—
> |> |> |Questions? First check the IFS FAQ at
> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |
> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |To unsubscribe send a blank email to leave-261576-
> |xxxxx@lists.osr.com
> |> |>
> |> |>
> |> |
> |> |
> |> |
> |> |—
> |> |Questions? First check the IFS FAQ at
> |> |https://www.osronline.com/article.cfm?id=17
> |> |
> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |To unsubscribe send a blank email to xxxxx@lists.osr.com
> |>
> |>
> |
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

Lokanadham_Rallapalli · September 8, 2006, 6:56am

Thanks for reply…

please send smaple code sir…

regards,
Lokanadham R

On 9/8/06, Gunko Andrey wrote:
>
> Did you receive any other IRP_MJ_READ requests? How you implemented it?
> How do you know that you are not receiving that requests? If you use
> IrpSp->FileObject->FileName to determine the file name it is not right to do
> this in Read handler. You can only do this on Create and add the name and
> FileObject into you internal buffer to compare it later in IRP_MJ_READ.
>
>
>
> Andrey **** Gunko
>
> * soft X pansion* GmbH & Co.KG
>
> Programmer
>
> Powered by eKnow-how
>
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
> Fax: +49 234 2984172 Internet: [www.maus-soft.com http:</http:>
>]
>
>
> ------------------------------
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *Lokanadham R
> Sent: Friday, September 08, 2006 11:25 AM
>
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] Memory Mapped files to read
>
>
>
> Thanks for reply…
>
>
>
> i’m not reciving IRP_MJ_READ requests first itself…
>
>
>
> please help me…
>
>
>
> regards,
>
> Lokanadham R
>
>
>
> On 9/8/06, Gunko Andrey wrote:
>
> You must track all IRP_MJ_READ requests and perform decryption only if one
> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO flags set
>
> in Irp->Flags. It means that you’ll receive decrypted memory and encrypted
> data on disk. If you do so you have no need to care about memory mapped
> files.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |Sent: Friday, September 08, 2006 10:12 AM
> |To: Windows File Systems Devs Interest List
> |Subject: [ntfsd] Memory Mapped files to read
> |
> |Hello Guru,
> |
> |When a program like notepad, uses Memory Mapped files to read content
> from
> |a
> |file, our mini filter should intercept those calls and then change the
> |contents in memory that are received by notepad. Is it possible yes/no if
>
> |yes, then how?
> |
> |Thanks & Regards,
> |Lokanadham R
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · September 8, 2006, 8:12am

Are you about read/write operations with file created/opened with
FILE_NO_INTERMEDIATE_BUFFERING flag set? If so for those operations
IRP_NOCACHE flag set. For those files cache will never initialize.

If you search IRP_NOCACHE in IFS you’ll find:
“IRP_NOCACHE - data for this I/O request should be read from the actual
backing media and not from cache”

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261596-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 1:42 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|
|> I think for third IRP_NOCACHE will set, or it doesn’t?
|
| No. This is an FSD decision to flush cache, purge pages and read from a
|disk.
| I wrote - “without IRP_NOCACHE”!
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> |Imagine an FSD which does the following:
|> |
|> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
|> |- Calls MmFlushImageSection, then CcFlushCache, then CcPurgeCacheSection
|> |that return success codes( this means- no user’s maps exist for this
|data
|> |stream )
|> |- Read data directly from a disk without using the Cache.
|>
|> I think for third IRP_NOCACHE will set, or it doesn’t?
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
|> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |Sent: Friday, September 08, 2006 1:09 PM
|> |To: Windows File Systems Devs Interest List
|> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |
|> |>Would you explain me?
|> |
|> |
|> |–
|> | Slava Imameyev, xxxxx@hotmail.com
|> |
|> |
|> |“Gunko Andrey” wrote in message
|> news:xxxxx@ntfsd…
|> |> But I’m not clear what is wrong with technique I wrote? Would you
|> explain
|> |> me?
|> |>
|> |> Andrey Gunko
|> |> soft Xpansion GmbH & Co.KG
|> |> Programmer
|> |> Powered by eKnow-how
|> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
|> 234
|> |> 2984172 Internet: [www.maus-soft.com]
|> |>
|> |>
|> |> |-----Original Message-----
|> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
|> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |Sent: Friday, September 08, 2006 12:25 PM
|> |> |To: Windows File Systems Devs Interest List
|> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |
|> |> |> You are about file operations without cache? But for those
|> operations
|> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |
|> |> |No. I wrote about the design of the FSD.
|> |> |
|> |> |There are 3 types of requests
|> |> |- Paging
|> |> |- NonCached
|> |> |- Other( simple user’s app read/write ).
|> |> |
|> |> | FSD may use the Cache Manager for the third type but may skip it for
|> |> some
|> |> |requests.
|> |> |
|> |> |–
|> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |
|> |> |
|> |> |“Gunko Andrey” wrote in message
|> |> news:xxxxx@ntfsd…
|> |> |> You are about file operations without cache? But for those
|> operations
|> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |>
|> |> |> Andrey Gunko
|> |> |> soft Xpansion GmbH & Co.KG
|> |> |> Programmer
|> |> |> Powered by eKnow-how
|> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
|+49
|> |> 234
|> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |>
|> |> |>
|> |> |> |-----Original Message-----
|> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
|> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |> |Sent: Friday, September 08, 2006 12:02 PM
|> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |> |
|> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
|> only
|> |> if
|> |> |> |one
|> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
|> |> flags
|> |> |> |set
|> |> |> |
|> |> |> |It is wrong to perform encryption/decryption in a filter using
|this
|> |> |> |technique.
|> |> |> |One can do this only if one sure- the underlying FSD always uses
|> the
|> |> |> Cache
|> |> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
|> |> |> |applications and the system ).
|> |> |> |
|> |> |> |–
|> |> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |> |
|> |> |> |
|> |> |> |“Gunko Andrey” wrote in message
|> |> |> news:xxxxx@ntfsd…
|> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
|> only
|> |> if
|> |> |> |one
|> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO
|> |> flags
|> |> |> |set
|> |> |> |> in Irp->Flags. It means that you’ll receive decrypted memory and
|> |> |> |encrypted
|> |> |> |> data on disk. If you do so you have no need to care about memory
|> |> |mapped
|> |> |> |> files.
|> |> |> |>
|> |> |> |> Andrey Gunko
|> |> |> |> soft Xpansion GmbH & Co.KG
|> |> |> |> Programmer
|> |> |> |> Powered by eKnow-how
|> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
|> |+49
|> |> |> 234
|> |> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |> |>
|> |> |> |>
|> |> |> |> |-----Original Message-----
|> |> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261561-
|> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
|> |> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
|> |> |> |> |
|> |> |> |> |Hello Guru,
|> |> |> |> |
|> |> |> |> |When a program like notepad, uses Memory Mapped files to read
|> |> content
|> |> |> |> from
|> |> |> |> |a
|> |> |> |> |file, our mini filter should intercept those calls and then
|> change
|> |> |the
|> |> |> |> |contents in memory that are received by notepad. Is it possible
|> |> |yes/no
|> |> |> |if
|> |> |> |> |yes, then how?
|> |> |> |> |
|> |> |> |> |Thanks & Regards,
|> |> |> |> |Lokanadham R
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |—
|> |> |> |> |Questions? First check the IFS FAQ at
|> |> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |> |
|> |> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |> |> |To unsubscribe send a blank email to leave-261561-
|> |> |xxxxx@lists.osr.com
|> |> |> |>
|> |> |> |>
|> |> |> |
|> |> |> |
|> |> |> |
|> |> |> |—
|> |> |> |Questions? First check the IFS FAQ at
|> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |
|> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |> |To unsubscribe send a blank email to leave-261576-
|> |xxxxx@lists.osr.com
|> |> |>
|> |> |>
|> |> |
|> |> |
|> |> |
|> |> |—
|> |> |Questions? First check the IFS FAQ at
|> |> |https://www.osronline.com/article.cfm?id=17
|> |> |
|> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |To unsubscribe send a blank email to leave-261587-
|xxxxx@lists.osr.com
|> |>
|> |>
|> |
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

Slava_Imameyev · September 8, 2006, 8:31am

> Are you about read/write operations with file created/opened with

FILE_NO_INTERMEDIATE_BUFFERING flag set?

You are missing the point.
This is an FSD decision from where to read data for a common read/write.

If you search IRP_NOCACHE in IFS you’ll find:

If you search this forum you will find an example when the FSD decides to
not use the cache( e.g. RDR ).

“IRP_NOCACHE - data for this I/O request should be read from the actual
backing media and not from cache”

If file is compressed the NTFS read/write data from the cache with the
write through.

–
Slava Imameyev, xxxxx@hotmail.com

“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> Are you about read/write operations with file created/opened with
> FILE_NO_INTERMEDIATE_BUFFERING flag set? If so for those operations
> IRP_NOCACHE flag set. For those files cache will never initialize.
>
> If you search IRP_NOCACHE in IFS you’ll find:
> “IRP_NOCACHE - data for this I/O request should be read from the actual
> backing media and not from cache”
>
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261596-
> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |Sent: Friday, September 08, 2006 1:42 PM
> |To: Windows File Systems Devs Interest List
> |Subject: Re:[ntfsd] Memory Mapped files to read
> |
> |
> |> I think for third IRP_NOCACHE will set, or it doesn’t?
> |
> | No. This is an FSD decision to flush cache, purge pages and read from a
> |disk.
> | I wrote - “without IRP_NOCACHE”!
> |
> |–
> | Slava Imameyev, xxxxx@hotmail.com
> |
> |
> |“Gunko Andrey” wrote in message
> news:xxxxx@ntfsd…
> |> |Imagine an FSD which does the following:
> |> |
> |> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
> |> |- Calls MmFlushImageSection, then CcFlushCache, then
> CcPurgeCacheSection
> |> |that return success codes( this means- no user’s maps exist for this
> |data
> |> |stream )
> |> |- Read data directly from a disk without using the Cache.
> |>
> |> I think for third IRP_NOCACHE will set, or it doesn’t?
> |>
> |> Andrey Gunko
> |> soft Xpansion GmbH & Co.KG
> |> Programmer
> |> Powered by eKnow-how
> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> 234
> |> 2984172 Internet: [www.maus-soft.com]
> |>
> |>
> |> |-----Original Message-----
> |> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |Sent: Friday, September 08, 2006 1:09 PM
> |> |To: Windows File Systems Devs Interest List
> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |
> |> |>Would you explain me?
> |> |
> |> |
> |> |–
> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |
> |> |
> |> |“Gunko Andrey” wrote in message
> |> news:xxxxx@ntfsd…
> |> |> But I’m not clear what is wrong with technique I wrote? Would you
> |> explain
> |> |> me?
> |> |>
> |> |> Andrey Gunko
> |> |> soft Xpansion GmbH & Co.KG
> |> |> Programmer
> |> |> Powered by eKnow-how
> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> |> 234
> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |>
> |> |>
> |> |> |-----Original Message-----
> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |> |Sent: Friday, September 08, 2006 12:25 PM
> |> |> |To: Windows File Systems Devs Interest List
> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |> |
> |> |> |> You are about file operations without cache? But for those
> |> operations
> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |> |
> |> |> |No. I wrote about the design of the FSD.
> |> |> |
> |> |> |There are 3 types of requests
> |> |> |- Paging
> |> |> |- NonCached
> |> |> |- Other( simple user’s app read/write ).
> |> |> |
> |> |> | FSD may use the Cache Manager for the third type but may skip it
> for
> |> |> some
> |> |> |requests.
> |> |> |
> |> |> |–
> |> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |> |
> |> |> |
> |> |> |“Gunko Andrey” wrote in message
> |> |> news:xxxxx@ntfsd…
> |> |> |> You are about file operations without cache? But for those
> |> operations
> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |> |>
> |> |> |> Andrey Gunko
> |> |> |> soft Xpansion GmbH & Co.KG
> |> |> |> Programmer
> |> |> |> Powered by eKnow-how
> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
> |+49
> |> |> 234
> |> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |> |>
> |> |> |>
> |> |> |> |-----Original Message-----
> |> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
> |> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |> |> |Sent: Friday, September 08, 2006 12:02 PM
> |> |> |> |To: Windows File Systems Devs Interest List
> |> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |> |> |
> |> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> |> only
> |> |> if
> |> |> |> |one
> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
> IRP_SYNCHRONOUS_PAGING_IO
> |> |> flags
> |> |> |> |set
> |> |> |> |
> |> |> |> |It is wrong to perform encryption/decryption in a filter using
> |this
> |> |> |> |technique.
> |> |> |> |One can do this only if one sure- the underlying FSD always uses
> |> the
> |> |> |> Cache
> |> |> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
> |> |> |> |applications and the system ).
> |> |> |> |
> |> |> |> |–
> |> |> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |> |> |
> |> |> |> |
> |> |> |> |“Gunko Andrey” wrote in message
> |> |> |> news:xxxxx@ntfsd…
> |> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> |> only
> |> |> if
> |> |> |> |one
> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
> IRP_SYNCHRONOUS_PAGING_IO
> |> |> flags
> |> |> |> |set
> |> |> |> |> in Irp->Flags. It means that you’ll receive decrypted memory
> and
> |> |> |> |encrypted
> |> |> |> |> data on disk. If you do so you have no need to care about
> memory
> |> |> |mapped
> |> |> |> |> files.
> |> |> |> |>
> |> |> |> |> Andrey Gunko
> |> |> |> |> soft Xpansion GmbH & Co.KG
> |> |> |> |> Programmer
> |> |> |> |> Powered by eKnow-how
> |> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
> Fax:
> |> |+49
> |> |> |> 234
> |> |> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |> |> |>
> |> |> |> |>
> |> |> |> |> |-----Original Message-----
> |> |> |> |> |From: xxxxx@lists.osr.com
> [mailto:bounce-261561-
> |> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
> |> |> |> |> |To: Windows File Systems Devs Interest List
> |> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
> |> |> |> |> |
> |> |> |> |> |Hello Guru,
> |> |> |> |> |
> |> |> |> |> |When a program like notepad, uses Memory Mapped files to read
> |> |> content
> |> |> |> |> from
> |> |> |> |> |a
> |> |> |> |> |file, our mini filter should intercept those calls and then
> |> change
> |> |> |the
> |> |> |> |> |contents in memory that are received by notepad. Is it
> possible
> |> |> |yes/no
> |> |> |> |if
> |> |> |> |> |yes, then how?
> |> |> |> |> |
> |> |> |> |> |Thanks & Regards,
> |> |> |> |> |Lokanadham R
> |> |> |> |> |
> |> |> |> |> |
> |> |> |> |> |—
> |> |> |> |> |Questions? First check the IFS FAQ at
> |> |> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |> |> |
> |> |> |> |> |You are currently subscribed to ntfsd as:
> xxxxx@maus.donetsk.ua
> |> |> |> |> |To unsubscribe send a blank email to leave-261561-
> |> |> |xxxxx@lists.osr.com
> |> |> |> |>
> |> |> |> |>
> |> |> |> |
> |> |> |> |
> |> |> |> |
> |> |> |> |—
> |> |> |> |Questions? First check the IFS FAQ at
> |> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |> |
> |> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |> |To unsubscribe send a blank email to leave-261576-
> |> |xxxxx@lists.osr.com
> |> |> |>
> |> |> |>
> |> |> |
> |> |> |
> |> |> |
> |> |> |—
> |> |> |Questions? First check the IFS FAQ at
> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |
> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |To unsubscribe send a blank email to leave-261587-
> |xxxxx@lists.osr.com
> |> |>
> |> |>
> |> |
> |> |
> |> |
> |> |—
> |> |Questions? First check the IFS FAQ at
> |> |https://www.osronline.com/article.cfm?id=17
> |> |
> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |To unsubscribe send a blank email to xxxxx@lists.osr.com
> |>
> |>
> |
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

OSR_Community_User · September 8, 2006, 9:51am

|If you search this forum you will find an example when the FSD decides to
|not use the cache( e.g. RDR ).
And what does it means?

I have not opportunity to search this forum now because of traffic exceed.
Please explain me the right technique to handle read/write requests.

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261610-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 3:31 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|> Are you about read/write operations with file created/opened with
|> FILE_NO_INTERMEDIATE_BUFFERING flag set?
|
|You are missing the point.
|This is an FSD decision from where to read data for a common read/write.
|
|> If you search IRP_NOCACHE in IFS you’ll find:
|
|If you search this forum you will find an example when the FSD decides to
|not use the cache( e.g. RDR ).
|
|> “IRP_NOCACHE - data for this I/O request should be read from the actual
|> backing media and not from cache”
|
| If file is compressed the NTFS read/write data from the cache with the
|write through.
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> Are you about read/write operations with file created/opened with
|> FILE_NO_INTERMEDIATE_BUFFERING flag set? If so for those operations
|> IRP_NOCACHE flag set. For those files cache will never initialize.
|>
|> If you search IRP_NOCACHE in IFS you’ll find:
|> “IRP_NOCACHE - data for this I/O request should be read from the actual
|> backing media and not from cache”
|>
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261596-
|> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |Sent: Friday, September 08, 2006 1:42 PM
|> |To: Windows File Systems Devs Interest List
|> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |
|> |
|> |> I think for third IRP_NOCACHE will set, or it doesn’t?
|> |
|> | No. This is an FSD decision to flush cache, purge pages and read from a
|> |disk.
|> | I wrote - “without IRP_NOCACHE”!
|> |
|> |–
|> | Slava Imameyev, xxxxx@hotmail.com
|> |
|> |
|> |“Gunko Andrey” wrote in message
|> news:xxxxx@ntfsd…
|> |> |Imagine an FSD which does the following:
|> |> |
|> |> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
|> |> |- Calls MmFlushImageSection, then CcFlushCache, then
|> CcPurgeCacheSection
|> |> |that return success codes( this means- no user’s maps exist for this
|> |data
|> |> |stream )
|> |> |- Read data directly from a disk without using the Cache.
|> |>
|> |> I think for third IRP_NOCACHE will set, or it doesn’t?
|> |>
|> |> Andrey Gunko
|> |> soft Xpansion GmbH & Co.KG
|> |> Programmer
|> |> Powered by eKnow-how
|> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
|> 234
|> |> 2984172 Internet: [www.maus-soft.com]
|> |>
|> |>
|> |> |-----Original Message-----
|> |> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
|> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |Sent: Friday, September 08, 2006 1:09 PM
|> |> |To: Windows File Systems Devs Interest List
|> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |
|> |> |>Would you explain me?
|> |> |
|> |> |
|> |> |–
|> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |
|> |> |
|> |> |“Gunko Andrey” wrote in message
|> |> news:xxxxx@ntfsd…
|> |> |> But I’m not clear what is wrong with technique I wrote? Would you
|> |> explain
|> |> |> me?
|> |> |>
|> |> |> Andrey Gunko
|> |> |> soft Xpansion GmbH & Co.KG
|> |> |> Programmer
|> |> |> Powered by eKnow-how
|> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
|+49
|> |> 234
|> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |>
|> |> |>
|> |> |> |-----Original Message-----
|> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
|> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |> |Sent: Friday, September 08, 2006 12:25 PM
|> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |> |
|> |> |> |> You are about file operations without cache? But for those
|> |> operations
|> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |> |
|> |> |> |No. I wrote about the design of the FSD.
|> |> |> |
|> |> |> |There are 3 types of requests
|> |> |> |- Paging
|> |> |> |- NonCached
|> |> |> |- Other( simple user’s app read/write ).
|> |> |> |
|> |> |> | FSD may use the Cache Manager for the third type but may skip it
|> for
|> |> |> some
|> |> |> |requests.
|> |> |> |
|> |> |> |–
|> |> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |> |
|> |> |> |
|> |> |> |“Gunko Andrey” wrote in message
|> |> |> news:xxxxx@ntfsd…
|> |> |> |> You are about file operations without cache? But for those
|> |> operations
|> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |> |>
|> |> |> |> Andrey Gunko
|> |> |> |> soft Xpansion GmbH & Co.KG
|> |> |> |> Programmer
|> |> |> |> Powered by eKnow-how
|> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
|> |+49
|> |> |> 234
|> |> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |> |>
|> |> |> |>
|> |> |> |> |-----Original Message-----
|> |> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
|> |> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |> |> |Sent: Friday, September 08, 2006 12:02 PM
|> |> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |> |> |
|> |> |> |> |> You must track all IRP_MJ_READ requests and perform
|decryption
|> |> only
|> |> |> if
|> |> |> |> |one
|> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
|> IRP_SYNCHRONOUS_PAGING_IO
|> |> |> flags
|> |> |> |> |set
|> |> |> |> |
|> |> |> |> |It is wrong to perform encryption/decryption in a filter using
|> |this
|> |> |> |> |technique.
|> |> |> |> |One can do this only if one sure- the underlying FSD always
|uses
|> |> the
|> |> |> |> Cache
|> |> |> |> |or only memory mapped files are used by the FSD’s clients (
|i.e.
|> |> |> |> |applications and the system ).
|> |> |> |> |
|> |> |> |> |–
|> |> |> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |“Gunko Andrey” wrote in message
|> |> |> |> news:xxxxx@ntfsd…
|> |> |> |> |> You must track all IRP_MJ_READ requests and perform
|decryption
|> |> only
|> |> |> if
|> |> |> |> |one
|> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
|> IRP_SYNCHRONOUS_PAGING_IO
|> |> |> flags
|> |> |> |> |set
|> |> |> |> |> in Irp->Flags. It means that you’ll receive decrypted memory
|> and
|> |> |> |> |encrypted
|> |> |> |> |> data on disk. If you do so you have no need to care about
|> memory
|> |> |> |mapped
|> |> |> |> |> files.
|> |> |> |> |>
|> |> |> |> |> Andrey Gunko
|> |> |> |> |> soft Xpansion GmbH & Co.KG
|> |> |> |> |> Programmer
|> |> |> |> |> Powered by eKnow-how
|> |> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
|> Fax:
|> |> |+49
|> |> |> |> 234
|> |> |> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |> |> |>
|> |> |> |> |>
|> |> |> |> |> |-----Original Message-----
|> |> |> |> |> |From: xxxxx@lists.osr.com
|> [mailto:bounce-261561-
|> |> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
|> |> |> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
|> |> |> |> |> |
|> |> |> |> |> |Hello Guru,
|> |> |> |> |> |
|> |> |> |> |> |When a program like notepad, uses Memory Mapped files to
|read
|> |> |> content
|> |> |> |> |> from
|> |> |> |> |> |a
|> |> |> |> |> |file, our mini filter should intercept those calls and then
|> |> change
|> |> |> |the
|> |> |> |> |> |contents in memory that are received by notepad. Is it
|> possible
|> |> |> |yes/no
|> |> |> |> |if
|> |> |> |> |> |yes, then how?
|> |> |> |> |> |
|> |> |> |> |> |Thanks & Regards,
|> |> |> |> |> |Lokanadham R
|> |> |> |> |> |
|> |> |> |> |> |
|> |> |> |> |> |—
|> |> |> |> |> |Questions? First check the IFS FAQ at
|> |> |> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |> |> |
|> |> |> |> |> |You are currently subscribed to ntfsd as:
|> xxxxx@maus.donetsk.ua
|> |> |> |> |> |To unsubscribe send a blank email to leave-261561-
|> |> |> |xxxxx@lists.osr.com
|> |> |> |> |>
|> |> |> |> |>
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |—
|> |> |> |> |Questions? First check the IFS FAQ at
|> |> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |> |
|> |> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |> |> |To unsubscribe send a blank email to leave-261576-
|> |> |xxxxx@lists.osr.com
|> |> |> |>
|> |> |> |>
|> |> |> |
|> |> |> |
|> |> |> |
|> |> |> |—
|> |> |> |Questions? First check the IFS FAQ at
|> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |
|> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |> |To unsubscribe send a blank email to leave-261587-
|> |xxxxx@lists.osr.com
|> |> |>
|> |> |>
|> |> |
|> |> |
|> |> |
|> |> |—
|> |> |Questions? First check the IFS FAQ at
|> |> |https://www.osronline.com/article.cfm?id=17
|> |> |
|> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |To unsubscribe send a blank email to leave-261592-
|xxxxx@lists.osr.com
|> |>
|> |>
|> |
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · September 8, 2006, 10:45am

It means exactly what it says. You call with what you think is a user
cached I/O and the underlying file system decides - for its OWN reasons

to treat this as a non-cached user I/O.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gunko Andrey
Sent: Friday, September 08, 2006 6:50 AM
To: ntfsd redirect
Subject: RE: [ntfsd] Memory Mapped files to read

|If you search this forum you will find an example when the FSD decides
to
|not use the cache( e.g. RDR ).
And what does it means?

I have not opportunity to search this forum now because of traffic
exceed.
Please explain me the right technique to handle read/write requests.

Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]

|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-261610-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Friday, September 08, 2006 3:31 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] Memory Mapped files to read
|
|> Are you about read/write operations with file created/opened with
|> FILE_NO_INTERMEDIATE_BUFFERING flag set?
|
|You are missing the point.
|This is an FSD decision from where to read data for a common
read/write.
|
|> If you search IRP_NOCACHE in IFS you’ll find:
|
|If you search this forum you will find an example when the FSD decides
to
|not use the cache( e.g. RDR ).
|
|> “IRP_NOCACHE - data for this I/O request should be read from the
actual
|> backing media and not from cache”
|
| If file is compressed the NTFS read/write data from the cache with the
|write through.
|
|–
| Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message
news:xxxxx@ntfsd…
|> Are you about read/write operations with file created/opened with
|> FILE_NO_INTERMEDIATE_BUFFERING flag set? If so for those operations
|> IRP_NOCACHE flag set. For those files cache will never initialize.
|>
|> If you search IRP_NOCACHE in IFS you’ll find:
|> “IRP_NOCACHE - data for this I/O request should be read from the
actual
|> backing media and not from cache”
|>
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
234
|> 2984172 Internet: [www.maus-soft.com]
|>
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-261596-
|> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |Sent: Friday, September 08, 2006 1:42 PM
|> |To: Windows File Systems Devs Interest List
|> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |
|> |
|> |> I think for third IRP_NOCACHE will set, or it doesn’t?
|> |
|> | No. This is an FSD decision to flush cache, purge pages and read
from a
|> |disk.
|> | I wrote - “without IRP_NOCACHE”!
|> |
|> |–
|> | Slava Imameyev, xxxxx@hotmail.com
|> |
|> |
|> |“Gunko Andrey” wrote in message
|> news:xxxxx@ntfsd…
|> |> |Imagine an FSD which does the following:
|> |> |
|> |> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE
flags
|> |> |- Calls MmFlushImageSection, then CcFlushCache, then
|> CcPurgeCacheSection
|> |> |that return success codes( this means- no user’s maps exist for
this
|> |data
|> |> |stream )
|> |> |- Read data directly from a disk without using the Cache.
|> |>
|> |> I think for third IRP_NOCACHE will set, or it doesn’t?
|> |>
|> |> Andrey Gunko
|> |> soft Xpansion GmbH & Co.KG
|> |> Programmer
|> |> Powered by eKnow-how
|> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
+49
|> 234
|> |> 2984172 Internet: [www.maus-soft.com]
|> |>
|> |>
|> |> |-----Original Message-----
|> |> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
|> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |Sent: Friday, September 08, 2006 1:09 PM
|> |> |To: Windows File Systems Devs Interest List
|> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |
|> |> |>Would you explain me?
|> |> |
|> |> |
|> |> |–
|> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |
|> |> |
|> |> |“Gunko Andrey” wrote in message
|> |> news:xxxxx@ntfsd…
|> |> |> But I’m not clear what is wrong with technique I wrote? Would
you
|> |> explain
|> |> |> me?
|> |> |>
|> |> |> Andrey Gunko
|> |> |> soft Xpansion GmbH & Co.KG
|> |> |> Programmer
|> |> |> Powered by eKnow-how
|> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
Fax:
|+49
|> |> 234
|> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |>
|> |> |>
|> |> |> |-----Original Message-----
|> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
|> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |> |Sent: Friday, September 08, 2006 12:25 PM
|> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |> |
|> |> |> |> You are about file operations without cache? But for those
|> |> operations
|> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |> |
|> |> |> |No. I wrote about the design of the FSD.
|> |> |> |
|> |> |> |There are 3 types of requests
|> |> |> |- Paging
|> |> |> |- NonCached
|> |> |> |- Other( simple user’s app read/write ).
|> |> |> |
|> |> |> | FSD may use the Cache Manager for the third type but may skip
it
|> for
|> |> |> some
|> |> |> |requests.
|> |> |> |
|> |> |> |–
|> |> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |> |
|> |> |> |
|> |> |> |“Gunko Andrey” wrote in message
|> |> |> news:xxxxx@ntfsd…
|> |> |> |> You are about file operations without cache? But for those
|> |> operations
|> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
|> |> |> |>
|> |> |> |> Andrey Gunko
|> |> |> |> soft Xpansion GmbH & Co.KG
|> |> |> |> Programmer
|> |> |> |> Powered by eKnow-how
|> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
Fax:
|> |+49
|> |> |> 234
|> |> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |> |>
|> |> |> |>
|> |> |> |> |-----Original Message-----
|> |> |> |> |From: xxxxx@lists.osr.com
[mailto:bounce-261576-
|> |> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|> |> |> |> |Sent: Friday, September 08, 2006 12:02 PM
|> |> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
|> |> |> |> |
|> |> |> |> |> You must track all IRP_MJ_READ requests and perform
|decryption
|> |> only
|> |> |> if
|> |> |> |> |one
|> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
|> IRP_SYNCHRONOUS_PAGING_IO
|> |> |> flags
|> |> |> |> |set
|> |> |> |> |
|> |> |> |> |It is wrong to perform encryption/decryption in a filter
using
|> |this
|> |> |> |> |technique.
|> |> |> |> |One can do this only if one sure- the underlying FSD always
|uses
|> |> the
|> |> |> |> Cache
|> |> |> |> |or only memory mapped files are used by the FSD’s clients (
|i.e.
|> |> |> |> |applications and the system ).
|> |> |> |> |
|> |> |> |> |–
|> |> |> |> | Slava Imameyev, xxxxx@hotmail.com
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |“Gunko Andrey” wrote in message
|> |> |> |> news:xxxxx@ntfsd…
|> |> |> |> |> You must track all IRP_MJ_READ requests and perform
|decryption
|> |> only
|> |> |> if
|> |> |> |> |one
|> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
|> IRP_SYNCHRONOUS_PAGING_IO
|> |> |> flags
|> |> |> |> |set
|> |> |> |> |> in Irp->Flags. It means that you’ll receive decrypted
memory
|> and
|> |> |> |> |encrypted
|> |> |> |> |> data on disk. If you do so you have no need to care about
|> memory
|> |> |> |mapped
|> |> |> |> |> files.
|> |> |> |> |>
|> |> |> |> |> Andrey Gunko
|> |> |> |> |> soft Xpansion GmbH & Co.KG
|> |> |> |> |> Programmer
|> |> |> |> |> Powered by eKnow-how
|> |> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
|> Fax:
|> |> |+49
|> |> |> |> 234
|> |> |> |> |> 2984172 Internet: [www.maus-soft.com]
|> |> |> |> |>
|> |> |> |> |>
|> |> |> |> |> |-----Original Message-----
|> |> |> |> |> |From: xxxxx@lists.osr.com
|> [mailto:bounce-261561-
|> |> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
|> |> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
|> |> |> |> |> |To: Windows File Systems Devs Interest List
|> |> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
|> |> |> |> |> |
|> |> |> |> |> |Hello Guru,
|> |> |> |> |> |
|> |> |> |> |> |When a program like notepad, uses Memory Mapped files to
|read
|> |> |> content
|> |> |> |> |> from
|> |> |> |> |> |a
|> |> |> |> |> |file, our mini filter should intercept those calls and
then
|> |> change
|> |> |> |the
|> |> |> |> |> |contents in memory that are received by notepad. Is it
|> possible
|> |> |> |yes/no
|> |> |> |> |if
|> |> |> |> |> |yes, then how?
|> |> |> |> |> |
|> |> |> |> |> |Thanks & Regards,
|> |> |> |> |> |Lokanadham R
|> |> |> |> |> |
|> |> |> |> |> |
|> |> |> |> |> |—
|> |> |> |> |> |Questions? First check the IFS FAQ at
|> |> |> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |> |> |
|> |> |> |> |> |You are currently subscribed to ntfsd as:
|> xxxxx@maus.donetsk.ua
|> |> |> |> |> |To unsubscribe send a blank email to leave-261561-
|> |> |> |xxxxx@lists.osr.com
|> |> |> |> |>
|> |> |> |> |>
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |
|> |> |> |> |—
|> |> |> |> |Questions? First check the IFS FAQ at
|> |> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |> |
|> |> |> |> |You are currently subscribed to ntfsd as:
xxxxx@maus.donetsk.ua
|> |> |> |> |To unsubscribe send a blank email to leave-261576-
|> |> |xxxxx@lists.osr.com
|> |> |> |>
|> |> |> |>
|> |> |> |
|> |> |> |
|> |> |> |
|> |> |> |—
|> |> |> |Questions? First check the IFS FAQ at
|> |> |> |https://www.osronline.com/article.cfm?id=17
|> |> |> |
|> |> |> |You are currently subscribed to ntfsd as:
xxxxx@maus.donetsk.ua
|> |> |> |To unsubscribe send a blank email to leave-261587-
|> |xxxxx@lists.osr.com
|> |> |>
|> |> |>
|> |> |
|> |> |
|> |> |
|> |> |—
|> |> |Questions? First check the IFS FAQ at
|> |> |https://www.osronline.com/article.cfm?id=17
|> |> |
|> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |> |To unsubscribe send a blank email to leave-261592-
|xxxxx@lists.osr.com
|> |>
|> |>
|> |
|> |
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to
xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · September 8, 2006, 11:50am

> It means exactly what it says. You call with what you think is a user

cached I/O and the underlying file system decides - for its OWN reasons

to treat this as a non-cached user I/O.

This is actually why it’s impossible to write data
modify filter for arbitraty file system, unless you make
filter which acts like layered file system.

Yesm MS file systems use cache the way how it’s discussed here,
but it’s not mandatory at all.

L.

OSR_Community_User · September 8, 2006, 12:48pm

Exactly - the reason we chose the layered FSD model in our DMK toolkit
was precisely because then we have the flexibility of largely ignoring
the details of the implementation underneath (hey, we don’t support the
RAW file system yet, although we’ve talked about what we’d have to do to
achieve that.)

This is particularly salient in Vista, which includes rewrites of old
file systems (read: “new behavior”) inclusion of previously rarely
observed file systems (read: “nfs”) and numerous other changes - from
the looks of things now, there are more changes in Vista for file
systems than there have been in all the time since 3.1 shipped…

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----

This is actually why it’s impossible to write data
modify filter for arbitraty file system, unless you make
filter which acts like layered file system.

Neil_Weicher · September 9, 2006, 7:24am

Andrey - what about if the file was opened normally with caching enabled,
updated, closed, and then immediately after is opened with NIFB? What
happens to the cached image? Thanks.

----- Original Message -----
From: “Gunko Andrey”
To: “Windows File Systems Devs Interest List”
Sent: Friday, September 08, 2006 8:12 AM
Subject: RE: [ntfsd] Memory Mapped files to read

> Are you about read/write operations with file created/opened with
> FILE_NO_INTERMEDIATE_BUFFERING flag set? If so for those operations
> IRP_NOCACHE flag set. For those files cache will never initialize.
>
> If you search IRP_NOCACHE in IFS you’ll find:
> “IRP_NOCACHE - data for this I/O request should be read from the actual
> backing media and not from cache”
>
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-261596-
> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |Sent: Friday, September 08, 2006 1:42 PM
> |To: Windows File Systems Devs Interest List
> |Subject: Re:[ntfsd] Memory Mapped files to read
> |
> |
> |> I think for third IRP_NOCACHE will set, or it doesn’t?
> |
> | No. This is an FSD decision to flush cache, purge pages and read from a
> |disk.
> | I wrote - “without IRP_NOCACHE”!
> |
> |–
> | Slava Imameyev, xxxxx@hotmail.com
> |
> |
> |“Gunko Andrey” wrote in message
> news:xxxxx@ntfsd…
> |> |Imagine an FSD which does the following:
> |> |
> |> |- Receives the IRP_MJ_READ without IRP_PAGING and IRP_NOCACHE flags
> |> |- Calls MmFlushImageSection, then CcFlushCache, then
> CcPurgeCacheSection
> |> |that return success codes( this means- no user’s maps exist for this
> |data
> |> |stream )
> |> |- Read data directly from a disk without using the Cache.
> |>
> |> I think for third IRP_NOCACHE will set, or it doesn’t?
> |>
> |> Andrey Gunko
> |> soft Xpansion GmbH & Co.KG
> |> Programmer
> |> Powered by eKnow-how
> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> 234
> |> 2984172 Internet: [www.maus-soft.com]
> |>
> |>
> |> |-----Original Message-----
> |> |From: xxxxx@lists.osr.com [mailto:bounce-261592-
> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |Sent: Friday, September 08, 2006 1:09 PM
> |> |To: Windows File Systems Devs Interest List
> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |
> |> |>Would you explain me?
> |> |
> |> |
> |> |–
> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |
> |> |
> |> |“Gunko Andrey” wrote in message
> |> news:xxxxx@ntfsd…
> |> |> But I’m not clear what is wrong with technique I wrote? Would you
> |> explain
> |> |> me?
> |> |>
> |> |> Andrey Gunko
> |> |> soft Xpansion GmbH & Co.KG
> |> |> Programmer
> |> |> Powered by eKnow-how
> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49
> |> 234
> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |>
> |> |>
> |> |> |-----Original Message-----
> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261587-
> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |> |Sent: Friday, September 08, 2006 12:25 PM
> |> |> |To: Windows File Systems Devs Interest List
> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |> |
> |> |> |> You are about file operations without cache? But for those
> |> operations
> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |> |
> |> |> |No. I wrote about the design of the FSD.
> |> |> |
> |> |> |There are 3 types of requests
> |> |> |- Paging
> |> |> |- NonCached
> |> |> |- Other( simple user’s app read/write ).
> |> |> |
> |> |> | FSD may use the Cache Manager for the third type but may skip it
> for
> |> |> some
> |> |> |requests.
> |> |> |
> |> |> |–
> |> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |> |
> |> |> |
> |> |> |“Gunko Andrey” wrote in message
> |> |> news:xxxxx@ntfsd…
> |> |> |> You are about file operations without cache? But for those
> |> operations
> |> |> |> IRP_NOCACHE flag will set. It’s not wrong.
> |> |> |>
> |> |> |> Andrey Gunko
> |> |> |> soft Xpansion GmbH & Co.KG
> |> |> |> Programmer
> |> |> |> Powered by eKnow-how
> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax:
> |+49
> |> |> 234
> |> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |> |>
> |> |> |>
> |> |> |> |-----Original Message-----
> |> |> |> |From: xxxxx@lists.osr.com [mailto:bounce-261576-
> |> |> |> |xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
> |> |> |> |Sent: Friday, September 08, 2006 12:02 PM
> |> |> |> |To: Windows File Systems Devs Interest List
> |> |> |> |Subject: Re:[ntfsd] Memory Mapped files to read
> |> |> |> |
> |> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> |> only
> |> |> if
> |> |> |> |one
> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
> IRP_SYNCHRONOUS_PAGING_IO
> |> |> flags
> |> |> |> |set
> |> |> |> |
> |> |> |> |It is wrong to perform encryption/decryption in a filter using
> |this
> |> |> |> |technique.
> |> |> |> |One can do this only if one sure- the underlying FSD always uses
> |> the
> |> |> |> Cache
> |> |> |> |or only memory mapped files are used by the FSD’s clients ( i.e.
> |> |> |> |applications and the system ).
> |> |> |> |
> |> |> |> |–
> |> |> |> | Slava Imameyev, xxxxx@hotmail.com
> |> |> |> |
> |> |> |> |
> |> |> |> |“Gunko Andrey” wrote in message
> |> |> |> news:xxxxx@ntfsd…
> |> |> |> |> You must track all IRP_MJ_READ requests and perform decryption
> |> only
> |> |> if
> |> |> |> |one
> |> |> |> |> of the IRP_NOCACHE or IRP_PAGING_IO or
> IRP_SYNCHRONOUS_PAGING_IO
> |> |> flags
> |> |> |> |set
> |> |> |> |> in Irp->Flags. It means that you’ll receive decrypted memory
> and
> |> |> |> |encrypted
> |> |> |> |> data on disk. If you do so you have no need to care about
> memory
> |> |> |mapped
> |> |> |> |> files.
> |> |> |> |>
> |> |> |> |> Andrey Gunko
> |> |> |> |> soft Xpansion GmbH & Co.KG
> |> |> |> |> Programmer
> |> |> |> |> Powered by eKnow-how
> |> |> |> |> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171
> Fax:
> |> |+49
> |> |> |> 234
> |> |> |> |> 2984172 Internet: [www.maus-soft.com]
> |> |> |> |>
> |> |> |> |>
> |> |> |> |> |-----Original Message-----
> |> |> |> |> |From: xxxxx@lists.osr.com
> [mailto:bounce-261561-
> |> |> |> |> |xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> |> |> |> |> |Sent: Friday, September 08, 2006 10:12 AM
> |> |> |> |> |To: Windows File Systems Devs Interest List
> |> |> |> |> |Subject: [ntfsd] Memory Mapped files to read
> |> |> |> |> |
> |> |> |> |> |Hello Guru,
> |> |> |> |> |
> |> |> |> |> |When a program like notepad, uses Memory Mapped files to read
> |> |> content
> |> |> |> |> from
> |> |> |> |> |a
> |> |> |> |> |file, our mini filter should intercept those calls and then
> |> change
> |> |> |the
> |> |> |> |> |contents in memory that are received by notepad. Is it
> possible
> |> |> |yes/no
> |> |> |> |if
> |> |> |> |> |yes, then how?
> |> |> |> |> |
> |> |> |> |> |Thanks & Regards,
> |> |> |> |> |Lokanadham R
> |> |> |> |> |
> |> |> |> |> |
> |> |> |> |> |—
> |> |> |> |> |Questions? First check the IFS FAQ at
> |> |> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |> |> |
> |> |> |> |> |You are currently subscribed to ntfsd as:
> xxxxx@maus.donetsk.ua
> |> |> |> |> |To unsubscribe send a blank email to leave-261561-
> |> |> |xxxxx@lists.osr.com
> |> |> |> |>
> |> |> |> |>
> |> |> |> |
> |> |> |> |
> |> |> |> |
> |> |> |> |—
> |> |> |> |Questions? First check the IFS FAQ at
> |> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |> |
> |> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |> |To unsubscribe send a blank email to leave-261576-
> |> |xxxxx@lists.osr.com
> |> |> |>
> |> |> |>
> |> |> |
> |> |> |
> |> |> |
> |> |> |—
> |> |> |Questions? First check the IFS FAQ at
> |> |> |https://www.osronline.com/article.cfm?id=17
> |> |> |
> |> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |> |To unsubscribe send a blank email to leave-261587-
> |xxxxx@lists.osr.com
> |> |>
> |> |>
> |> |
> |> |
> |> |
> |> |—
> |> |Questions? First check the IFS FAQ at
> |> |https://www.osronline.com/article.cfm?id=17
> |> |
> |> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |> |To unsubscribe send a blank email to xxxxx@lists.osr.com
> |>
> |>
> |
> |
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@netlib.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>