No IRP_MJ_WRITE on .exe file

NTFSD
1

I was monitoring \debug folder of workspace in VC++.
When i compile code in VC++, i didn’t find any
IRP_MJ_WRITE on .exe file. But file was created
inDebug folder. Can anybody explian this?

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

2

Can you find IRP_MJ_WRITE to some other file followed by rename?

“rahul naik” wrote in message news:xxxxx@ntfsd…
>I was monitoring \debug folder of workspace in VC++.
> When i compile code in VC++, i didn’t find any
> IRP_MJ_WRITE on .exe file. But file was created
> inDebug folder. Can anybody explian this?
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

3

> Can you find IRP_MJ_WRITE to some other file followed by rename?
FileSpy diligently shows 2 writes by mt.exe to the exe being built:

1 07:39:12.421 0 mt.exe IRP_MJ_WRITE … \bin_debug\test.exe STATUS_SUCCESS
Offset 00000000-00000000 ToWrite 5E00 Written 5E00
2 07:39:12.546 0 mt.exe IRP_MJ_WRITE …\bin_debug\test.exe STATUS_SUCCESS
Offset 00000000-00000000 ToWrite 6000 Written 6000

Probably, he expected writes from devenv.exe or link.exe or whatever.

----- Original Message -----
From: “Lyndon J. Clarke”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Monday, May 01, 2006 3:13 AM
Subject: Re:[ntfsd] No IRP_MJ_WRITE on .exe file

> Can you find IRP_MJ_WRITE to some other file followed by rename?
>
> “rahul naik” wrote in message news:xxxxx@ntfsd…
>>I was monitoring \debug folder of workspace in VC++.
>> When i compile code in VC++, i didn’t find any
>> IRP_MJ_WRITE on .exe file. But file was created
>> inDebug folder. Can anybody explian this?
>>
>>
>> __________________________________________________
>> Do You Yahoo!?
>> Tired of spam? Yahoo! Mail has the best spam protection around
>> http://mail.yahoo.com
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>