On Win7X64, Cannot capture PAGING READ for MSWORD reading over networkM

NTFSD
1

I found on Win7x64 my minifilter can not capture a complete paging read when ms-word read a file from network. Only paging read for first 4K was captured. I found msword issued IOCTL_LMR_DISABLE_LOCAL_BUFFERING and I rejected it from my minifilter. but i still cannot capture the full paging read for whole file.

What could be the reason? thanks…

I pasted the log below:

19:47:44.1423852 WINWORD.EXE 196560 ReadFile \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx SUCCESS Offset: 0, Length: 24, Priority: Normal

19:47:44.1425467 WINWORD.EXE 196560 ReadFile \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx SUCCESS Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal

19:47:44.2122265 WINWORD.EXE 196560 FileSystemControl \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx INVALID DEVICE REQUEST Control: IOCTL_LMR_DISABLE_LOCAL_BUFFERING

19:47:44.2122652 WINWORD.EXE 196560 FileSystemControl \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx INVALID DEVICE REQUEST Control: FSCTL_LMR_GET_HINT_SIZE

19:47:44.2450819 WINWORD.EXE 196560 ReadFile \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx SUCCESS Offset: 0, Length: 33,914, Priority: Normal
[The non-paging read for the whole file, but there is no paging read triggered]

19:47:44.3206934 WINWORD.EXE 196560 ReadFile \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx SUCCESS Offset: 0, Length: 24, Priority: Normal

19:47:44.9269426 WINWORD.EXE 196560 FileSystemControl
\192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx INVALID DEVICE
REQUEST Control: FSCTL_CREATE_OR_GET_OBJECT_ID

19:47:45.9088344 WINWORD.EXE 196560 FileSystemControl \192.168.1.105\d\FFFASDFDSAFSDFASDFASDFAS - Copy (2).docx INVALID DEVICE REQUEST Control: FSCTL_CREATE_OR_GET_OBJECT_ID

2

This is always an issue over the network - you cannot control the caching policy of the underlying redirector.

If the file system doesn’t cache, you won’t see paging I/O operations, because the underlying file system is not faulting data into the cache.

You must build your mini-filter in such a way that it does not depend upon the caching policy of the underlying redirector.

Tony
OSR