Hi, thanks for checking out my post. I have two questions related to minifilter driver behavior during write operations:
-
In a NonCached I/O operation where the PagingIo flag is false, will the value of
Data->Iopb->Parameters.Write.Length
in the PreWrite callback be sector-aligned? -
If I'm performing a NonCached I/O write with PagingIo set to false, what will be the value of the file size in the PreWrite stage? Specifically, will
((PFSRTL_ADVANCED_FCB_HEADER)FltObjects->FileObject->FsContext)->FileSize.QuadPart
reflect the original file size before the write, or the updated size after the write?
Would appreciate any insights or clarifications. Thanks!