Minispy Filter: Modified file offset and length

NTFSD
1

Hi,

I am trying to modify the minispy filter to log the modified file offset and length whenever IRP_MJ_WRITE request invoked. Actually, it gives byteOffset as zero (0) always and Length will be full file size. It doesn’t give the modified offset position and length. Anyone can please let me know what type of changes are required in minispy minifilter to log the above information.

Thanks in advance.

2

I am not sure what case you are testing or what writes you are looking
at. If you are only looking at paging IO then this will generally be
page aligned regions of the area of the file which was modified. If you
are looking at non-paging writes then it would depend more on the
application which you are using to modify the content.

If you are interested in the exact byte range that has changed then you
would need to compare the content on disk to what is getting written to
be certain. Otherwise you will most likely be receiving a write for a
range of bytes that cover the modified region.

Pete

On 1/2/2014 10:41 PM, xxxxx@gmail.com wrote:

Hi,

I am trying to modify the minispy filter to log the modified file offset and length whenever IRP_MJ_WRITE request invoked. Actually, it gives byteOffset as zero (0) always and Length will be full file size. It doesn’t give the modified offset position and length. Anyone can please let me know what type of changes are required in minispy minifilter to log the above information.

Thanks in advance.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295