[NTFSD]HOW TO DO STH. AT IRP_MJ_READ

NTFSD
1

hi, all
i was the first time to write an IFS driver and also the first time to
write a DDK kernel-mode driver.
i have a lot of question did not find answer at osronline(maybe it is toooo
simple), Is there anyone could help me?
i should do a drive to watch any application do sth. with any
file(txt,doc,xls…etc.). and there is encrypte opertation to the file
for example: File a.txt only could be read. File b.doc could not be opened.
So, i want to determine the file at IRP_MJ_CREATE, and save the fileobject
in hashtable(just like filemon). And then at the IRP_MJ_READ, i prepare the
irpSp->FileObject with the element of hashtable, if the irpSp->FileObject
has alread in hashtable and it is use Irp->userbuffer to save the read
result, then i change the first 4 byte data with a special string (just test
can i change the data, use “AAAA” or anything else).Or at IRP_MJ_WRITE, just
like IRP_MJ_READ, i change the data in Irp->userbuffer, and send to the next
driver.At last at IRP_MJ_CLOSE, i delete the fileobject which is in the
hashtable.
For test, i use notepad to open a txt file at first.(i know MS office is
more complex)
i have met A LOT OF problem.

  1. During the double click a txt file to open it. i found a lot of access by
    explore and notepad. There are open the real file of this txt, and open the
    link of this txt and open a file which name is like
    D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some time
    only read 24 byte from the file(i think it is read some information by
    explore) and some time will read the whole file. Shall i watch all kind of
    these file access?
    2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ,
    finally when the txt file is opened, it displaed original data. Did i miss
    sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the data to
    be wriet)
    3.i also want to disable the file copy from explore sometimes. Could i do
    this in the IFS driver? In the driver , i only get 2 file opened IRP, and
    read, write IRP. But i don’t know current is copying.
    4.i have the encryptiong DLL from other company. If i want to use DLL to do
    the operationg, shall i use IOCTRL to transfer the data from kernel mode to
    an usermode application to encrypt it?
    i think maybe there are some reason of FastIo or Buffered IO. i only find
    some document of it at MS and OSRONLINE. Is there some sample of it?
    i hope you can understand my means. If there is any question, please let me
    know.
    THANK you so much!

–
yours Sean

2

Hi Sean.

I could not understand some of the details of this e-mail but I think I
know the gist of what you are trying to achieve. I think the following
information might be helpful to determine whats going on with your
driver.

Notepad memory maps files. I think that’s why when you open it for the
second time, you don’t get irp_mj_reads but you see the original data. I
think that could explain points 1 & 2. I could not understand what you
are trying to do in point 3. As far as point 4 is concerned, I think you
might be stuck with transferring data from user mode to kernel mode and
vice versa unless you wanted to get more complex and use directIO or
shared buffers between user mode and kernel mode.

Amitabh Mathrawala

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of sean liu
Sent: Monday, May 16, 2005 12:44 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ

hi, all

i was the first time to write an IFS driver and also the first time to
write a DDK kernel-mode driver.

i have a lot of question did not find answer at osronline(maybe it is
toooo simple), Is there anyone could help me?

i should do a drive to watch any application do sth. with any
file(txt,doc,xls…etc.). and there is encrypte opertation to the file

for example: File a.txt only could be read. File b.doc could not be
opened.

So, i want to determine the file at IRP_MJ_CREATE, and save the
fileobject in hashtable(just like filemon). And then at the IRP_MJ_READ,
i prepare the irpSp->FileObject with the element of hashtable, if the
irpSp->FileObject has alread in hashtable and it is use Irp->userbuffer
to save the read result, then i change the first 4 byte data with a
special string (just test can i change the data, use “AAAA” or anything
else).Or at IRP_MJ_WRITE, just like IRP_MJ_READ, i change the data in
Irp->userbuffer, and send to the next driver.At last at IRP_MJ_CLOSE, i
delete the fileobject which is in the hashtable.

For test, i use notepad to open a txt file at first.(i know MS office is
more complex)

i have met A LOT OF problem.

  1. During the double click a txt file to open it. i found a lot of
    access by explore and notepad. There are open the real file of this txt,
    and open the link of this txt and open a file which name is like
    D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some
    time only read 24 byte from the file(i think it is read some information
    by explore) and some time will read the whole file. Shall i watch all
    kind of these file access?

2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ,
finally when the txt file is opened, it displaed original data. Did i
miss sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the
data to be wriet)

3.i also want to disable the file copy from explore sometimes. Could i
do this in the IFS driver? In the driver , i only get 2 file opened IRP,
and read, write IRP. But i don’t know current is copying.

4.i have the encryptiong DLL from other company. If i want to use DLL to
do the operationg, shall i use IOCTRL to transfer the data from kernel
mode to an usermode application to encrypt it?

i think maybe there are some reason of FastIo or Buffered IO. i only
find some document of it at MS and OSRONLINE. Is there some sample of
it?

i hope you can understand my means. If there is any question, please let
me know.

THANK you so much!

–
yours Sean

— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed
to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a
blank email to xxxxx@lists.osr.com

3

Hi Amitabh
Thank you so much for your help
sorry for my english.
The first i want to do is a encryption file system.
when application open a file, i should decrypte it and send the data to
application.
when application save a file, i should encrypte the data get from user and
save it to the disk.
so i try to catch data at the IRP_MJ_READ and IRP_MJ_WRITE
and i found even i change the data in userbuffer at IRP_MJ_READ, the
application(notepad)also display the original data.
Could you tell me where could find some documents about memory maps files.
And next i want to disable the file copy operation in explore.
could i do it in the IFS driver?
The last is now i get a encryption tool with DLL file. if i want to use it
in my IFS driver, shall i send data to user-mode, and do encrypte in
user-mode?
thank you again for your help

On 5/17/05, Amitabh Mathrawala wrote:
>
> Hi Sean.
>
> I could not understand some of the details of this e-mail but I think I
> know the gist of what you are trying to achieve. I think the following
> information might be helpful to determine whats going on with your driver.
>
> Notepad memory maps files. I think that’s why when you open it for the
> second time, you don’t get irp_mj_reads but you see the original data. I
> think that could explain points 1 & 2. I could not understand what you are
> trying to do in point 3. As far as point 4 is concerned, I think you might
> be stuck with transferring data from user mode to kernel mode and vice versa
> unless you wanted to get more complex and use directIO or shared buffers
> between user mode and kernel mode.
>
> Amitabh Mathrawala
>
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *sean liu
> Sent: Monday, May 16, 2005 12:44 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ
>
> hi, all
>
> i was the first time to write an IFS driver and also the first time to
> write a DDK kernel-mode driver.
>
> i have a lot of question did not find answer at osronline(maybe it is
> toooo simple), Is there anyone could help me?
>
> i should do a drive to watch any application do sth. with any
> file(txt,doc,xls…etc.). and there is encrypte opertation to the file
>
> for example: File a.txt only could be read. File b.doc could not be
> opened.
>
> So, i want to determine the file at IRP_MJ_CREATE, and save the
> fileobject in hashtable(just like filemon). And then at the IRP_MJ_READ, i
> prepare the irpSp->FileObject with the element of hashtable, if the
> irpSp->FileObject has alread in hashtable and it is use Irp->userbuffer to
> save the read result, then i change the first 4 byte data with a special
> string (just test can i change the data, use “AAAA” or anything else).Or at
> IRP_MJ_WRITE, just like IRP_MJ_READ, i change the data in Irp->userbuffer,
> and send to the next driver.At last at IRP_MJ_CLOSE, i delete the
> fileobject which is in the hashtable.
>
> For test, i use notepad to open a txt file at first.(i know MS office is
> more complex)
>
> i have met A LOT OF problem.
>
> 1. During the double click a txt file to open it. i found a lot of access
> by explore and notepad. There are open the real file of this txt, and open
> the link of this txt and open a file which name is like
> D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some time
> only read 24 byte from the file(i think it is read some information by
> explore) and some time will read the whole file. Shall i watch all kind of
> these file access?
>
> 2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ,
> finally when the txt file is opened, it displaed original data. Did i miss
> sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the data to
> be wriet)
>
> 3.i also want to disable the file copy from explore sometimes. Could i do
> this in the IFS driver? In the driver , i only get 2 file opened IRP, and
> read, write IRP. But i don’t know current is copying.
>
> 4.i have the encryptiong DLL from other company. If i want to use DLL to
> do the operationg, shall i use IOCTRL to transfer the data from kernel mode
> to an usermode application to encrypt it?
>
> i think maybe there are some reason of FastIo or Buffered IO. i only find
> some document of it at MS and OSRONLINE. Is there some sample of it?
>
> i hope you can understand my means. If there is any question, please let
> me know.
>
> THANK you so much!
>
>
>
> –
> yours Sean
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email to xxxxx@lists.osr.com
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com

–
yours Sean

4

Couple places you could look at for memory mapped file —

  1. Assuming that you using ifs kit., some version of ifs kit has a doc folder, and you will find docs there for filter design, and other stuff.

  2. Osronline might have quite a few articles on this, that would help.

  3. If you happen to have the “Filesystem internals” book that has explaination

  4. If you have “Windows internal” book that has some explanation

  5. If you want to see it from application point of view " Jeff Reichter’s " Advance windows book has explanation.

  6. Finally MSDN documents should have some explanation…

Basically you should look at the fast i/o , section object etc to see …
-pro
----- Original Message -----
From: sean liu
To: Windows File Systems Devs Interest List
Sent: Monday, May 16, 2005 9:57 PM
Subject: Re: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ

Hi Amitabh
Thank you so much for your help

sorry for my english.

The first i want to do is a encryption file system.
when application open a file, i should decrypte it and send the data to application.
when application save a file, i should encrypte the data get from user and save it to the disk.

so i try to catch data at the IRP_MJ_READ and IRP_MJ_WRITE
and i found even i change the data in userbuffer at IRP_MJ_READ, the application(notepad)also display the original data.

Could you tell me where could find some documents about memory maps files.

And next i want to disable the file copy operation in explore.
could i do it in the IFS driver?

The last is now i get a encryption tool with DLL file. if i want to use it in my IFS driver, shall i send data to user-mode, and do encrypte in user-mode?

thank you again for your help

On 5/17/05, Amitabh Mathrawala wrote:
Hi Sean.

I could not understand some of the details of this e-mail but I think I know the gist of what you are trying to achieve. I think the following information might be helpful to determine whats going on with your driver.

Notepad memory maps files. I think that’s why when you open it for the second time, you don’t get irp_mj_reads but you see the original data. I think that could explain points 1 & 2. I could not understand what you are trying to do in point 3. As far as point 4 is concerned, I think you might be stuck with transferring data from user mode to kernel mode and vice versa unless you wanted to get more complex and use directIO or shared buffers between user mode and kernel mode.

Amitabh Mathrawala

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of sean liu
Sent: Monday, May 16, 2005 12:44 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ

hi, all

i was the first time to write an IFS driver and also the first time to write a DDK kernel-mode driver.

i have a lot of question did not find answer at osronline(maybe it is toooo simple), Is there anyone could help me?

i should do a drive to watch any application do sth. with any file(txt,doc,xls…etc.). and there is encrypte opertation to the file

for example: File a.txt only could be read. File b.doc could not be opened.

So, i want to determine the file at IRP_MJ_CREATE, and save the fileobject in hashtable(just like filemon). And then at the IRP_MJ_READ, i prepare the irpSp->FileObject with the element of hashtable, if the irpSp->FileObject has alread in hashtable and it is use Irp->userbuffer to save the read result, then i change the first 4 byte data with a special string (just test can i change the data, use “AAAA” or anything else).Or at IRP_MJ_WRITE, just like IRP_MJ_READ, i change the data in Irp->userbuffer, and send to the next driver.At last at IRP_MJ_CLOSE, i delete the fileobject which is in the hashtable.

For test, i use notepad to open a txt file at first.(i know MS office is more complex)

i have met A LOT OF problem.

1. During the double click a txt file to open it. i found a lot of access by explore and notepad. There are open the real file of this txt, and open the link of this txt and open a file which name is like D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some time only read 24 byte from the file(i think it is read some information by explore) and some time will read the whole file. Shall i watch all kind of these file access?

2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ, finally when the txt file is opened, it displaed original data. Did i miss sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the data to be wriet)

3.i also want to disable the file copy from explore sometimes. Could i do this in the IFS driver? In the driver , i only get 2 file opened IRP, and read, write IRP. But i don’t know current is copying.

4.i have the encryptiong DLL from other company. If i want to use DLL to do the operationg, shall i use IOCTRL to transfer the data from kernel mode to an usermode application to encrypt it?

i think maybe there are some reason of FastIo or Buffered IO. i only find some document of it at MS and OSRONLINE. Is there some sample of it?

i hope you can understand my means. If there is any question, please let me know.

THANK you so much!

–
yours Sean

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
yours Sean — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Memory-mapped files are implemented by using READ/WRITE IRPs with PAGING_IO bit set. Pay attention to MDLs in these IRPs.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: sean liu
To: Windows File Systems Devs Interest List
Sent: Tuesday, May 17, 2005 8:57 AM
Subject: Re: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ

Hi Amitabh
Thank you so much for your help

sorry for my english.

The first i want to do is a encryption file system.
when application open a file, i should decrypte it and send the data to application.
when application save a file, i should encrypte the data get from user and save it to the disk.

so i try to catch data at the IRP_MJ_READ and IRP_MJ_WRITE
and i found even i change the data in userbuffer at IRP_MJ_READ, the application(notepad)also display the original data.

Could you tell me where could find some documents about memory maps files.

And next i want to disable the file copy operation in explore.
could i do it in the IFS driver?

The last is now i get a encryption tool with DLL file. if i want to use it in my IFS driver, shall i send data to user-mode, and do encrypte in user-mode?

thank you again for your help

On 5/17/05, Amitabh Mathrawala wrote:
Hi Sean.

I could not understand some of the details of this e-mail but I think I know the gist of what you are trying to achieve. I think the following information might be helpful to determine whats going on with your driver.

Notepad memory maps files. I think that’s why when you open it for the second time, you don’t get irp_mj_reads but you see the original data. I think that could explain points 1 & 2. I could not understand what you are trying to do in point 3. As far as point 4 is concerned, I think you might be stuck with transferring data from user mode to kernel mode and vice versa unless you wanted to get more complex and use directIO or shared buffers between user mode and kernel mode.

Amitabh Mathrawala

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of sean liu
Sent: Monday, May 16, 2005 12:44 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ

hi, all

i was the first time to write an IFS driver and also the first time to write a DDK kernel-mode driver.

i have a lot of question did not find answer at osronline(maybe it is toooo simple), Is there anyone could help me?

i should do a drive to watch any application do sth. with any file(txt,doc,xls…etc.). and there is encrypte opertation to the file

for example: File a.txt only could be read. File b.doc could not be opened.

So, i want to determine the file at IRP_MJ_CREATE, and save the fileobject in hashtable(just like filemon). And then at the IRP_MJ_READ, i prepare the irpSp->FileObject with the element of hashtable, if the irpSp->FileObject has alread in hashtable and it is use Irp->userbuffer to save the read result, then i change the first 4 byte data with a special string (just test can i change the data, use “AAAA” or anything else).Or at IRP_MJ_WRITE, just like IRP_MJ_READ, i change the data in Irp->userbuffer, and send to the next driver.At last at IRP_MJ_CLOSE, i delete the fileobject which is in the hashtable.

For test, i use notepad to open a txt file at first.(i know MS office is more complex)

i have met A LOT OF problem.

1. During the double click a txt file to open it. i found a lot of access by explore and notepad. There are open the real file of this txt, and open the link of this txt and open a file which name is like D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some time only read 24 byte from the file(i think it is read some information by explore) and some time will read the whole file. Shall i watch all kind of these file access?

2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ, finally when the txt file is opened, it displaed original data. Did i miss sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the data to be wriet)

3.i also want to disable the file copy from explore sometimes. Could i do this in the IFS driver? In the driver , i only get 2 file opened IRP, and read, write IRP. But i don’t know current is copying.

4.i have the encryptiong DLL from other company. If i want to use DLL to do the operationg, shall i use IOCTRL to transfer the data from kernel mode to an usermode application to encrypt it?

i think maybe there are some reason of FastIo or Buffered IO. i only find some document of it at MS and OSRONLINE. Is there some sample of it?

i hope you can understand my means. If there is any question, please let me know.

THANK you so much!

–
yours Sean

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
yours Sean — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Hi all
thank you for your advice
Now i begin to read design guide carefully

On 5/18/05, Maxim S. Shatskih wrote:
>
> Memory-mapped files are implemented by using READ/WRITE IRPs with
> PAGING_IO bit set. Pay attention to MDLs in these IRPs.
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: sean liu
> To: Windows File Systems Devs Interest List
> Sent: Tuesday, May 17, 2005 8:57 AM
> Subject: Re: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ
>
> Hi Amitabh
> Thank you so much for your help
> sorry for my english.
> The first i want to do is a encryption file system.
> when application open a file, i should decrypte it and send the data to
> application.
> when application save a file, i should encrypte the data get from user and
> save it to the disk.
> so i try to catch data at the IRP_MJ_READ and IRP_MJ_WRITE
> and i found even i change the data in userbuffer at IRP_MJ_READ, the
> application(notepad)also display the original data.
> Could you tell me where could find some documents about memory maps
> files.
> And next i want to disable the file copy operation in explore.
> could i do it in the IFS driver?
> The last is now i get a encryption tool with DLL file. if i want to use
> it in my IFS driver, shall i send data to user-mode, and do encrypte in
> user-mode?
> thank you again for your help
>
>
> On 5/17/05, Amitabh Mathrawala wrote:
>
> > Hi Sean.
> >
> > I could not understand some of the details of this e-mail but I think I
> > know the gist of what you are trying to achieve. I think the following
> > information might be helpful to determine whats going on with your driver.
> >
> > Notepad memory maps files. I think that’s why when you open it for the
> > second time, you don’t get irp_mj_reads but you see the original data. I
> > think that could explain points 1 & 2. I could not understand what you are
> > trying to do in point 3. As far as point 4 is concerned, I think you might
> > be stuck with transferring data from user mode to kernel mode and vice versa
> > unless you wanted to get more complex and use directIO or shared buffers
> > between user mode and kernel mode.
> >
> > Amitabh Mathrawala
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:
> > xxxxx@lists.osr.com] *On Behalf Of *sean liu
> > Sent: Monday, May 16, 2005 12:44 AM
> > To: Windows File Systems Devs Interest List
> > Subject: [ntfsd] [NTFSD]HOW TO DO STH. AT IRP_MJ_READ
> >
> > hi, all
> >
> > i was the first time to write an IFS driver and also the first time to
> > write a DDK kernel-mode driver.
> >
> > i have a lot of question did not find answer at osronline(maybe it is
> > toooo simple), Is there anyone could help me?
> >
> > i should do a drive to watch any application do sth. with any
> > file(txt,doc,xls…etc.). and there is encrypte opertation to the file
> >
> > for example: File a.txt only could be read. File b.doc could not be
> > opened.
> >
> > So, i want to determine the file at IRP_MJ_CREATE, and save the
> > fileobject in hashtable(just like filemon). And then at the IRP_MJ_READ, i
> > prepare the irpSp->FileObject with the element of hashtable, if the
> > irpSp->FileObject has alread in hashtable and it is use Irp->userbuffer to
> > save the read result, then i change the first 4 byte data with a special
> > string (just test can i change the data, use “AAAA” or anything else).Or at
> > IRP_MJ_WRITE, just like IRP_MJ_READ, i change the data in Irp->userbuffer,
> > and send to the next driver.At last at IRP_MJ_CLOSE, i delete the
> > fileobject which is in the hashtable.
> >
> > For test, i use notepad to open a txt file at first.(i know MS office
> > is more complex)
> >
> > i have met A LOT OF problem.
> >
> > 1. During the double click a txt file to open it. i found a lot of
> > access by explore and notepad. There are open the real file of this txt, and
> > open the link of this txt and open a file which name is like
> > D:\testfolder\test.txt:|&data&“#$!”#$!$(is this a stream type?). Some time
> > only read 24 byte from the file(i think it is read some information by
> > explore) and some time will read the whole file. Shall i watch all kind of
> > these file access?
> >
> > 2.Even if i change the data of Irp->userbuffer during the IRP_MJ_READ,
> > finally when the txt file is opened, it displaed original data. Did i miss
> > sth.??(when in IRP_MJ_WRITE it is ok, i successfully to change the data to
> > be wriet)
> >
> > 3.i also want to disable the file copy from explore sometimes. Could i
> > do this in the IFS driver? In the driver , i only get 2 file opened IRP, and
> > read, write IRP. But i don’t know current is copying.
> >
> > 4.i have the encryptiong DLL from other company. If i want to use DLL
> > to do the operationg, shall i use IOCTRL to transfer the data from kernel
> > mode to an usermode application to encrypt it?
> >
> > i think maybe there are some reason of FastIo or Buffered IO. i only
> > find some document of it at MS and OSRONLINE. Is there some sample of it?
> >
> > i hope you can understand my means. If there is any question, please
> > let me know.
> >
> > THANK you so much!
> >
> >
> >
> > –
> > yours Sean
> >
> > — Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> > to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> > email to %%email.unsub%% <%25%25email.unsub%25%25>
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
> > ‘’
> > To unsubscribe send a blank email to %%email.unsub%%<%25%25email.unsub%25%25>
>
>
>
>
> –
> yours Sean — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email to %%email.unsub%%
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
yours Sean