NtCreateSection vs. filter driver

NTFSD
1

Hi,

When an application creates a new file, then creates
the section using NtCreateSection (nonzero section size),
it causes to call IRP_MJ_SET_INFORMATION
(EndOfFileInformation) to achieve the size to be
the required section size and to be filled by zeros.
The file will get enlarged and zeroed without any WRITE call.

How to handle this situation in the filter driver
which modifies the file data ?

I think about to zero the file manually, from the filter
driver in the case when the file is being
IRP_MJ_SET_INFORMATIONed with the new
size larger then the current size.

But I don’t know, if it is allowed to write to
a file which has been mapped into memory using
NtCreateSection.

L.

2

> How to handle this situation in the filter driver

which modifies the file data ?

No need in special handling of such a situation if your filter filters the
paging/noncached IO only.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

> No need in special handling of such a situation if your filter filters the

paging/noncached IO only.

Strange thing is that I don’t see any WRITEs.
Maybe I missed them. I’ll check again.

But what about this:

file = CreateFile(NewFile)
SetFilePointer(file, 0x100000, NULL, FILE_BEGIN)
SetEndOFile(file)
CloseHandle(file).

This will generate
IRP_MJ_CREATE
IRP_MJ_SET_INFORMATION
IRP_MJ_CLEANUP
IRP_MJ_CLOSE

L.