RE: [SPAM] - Re: No IRP_MJ_READ if I use ZwCreateFile - Bayesian Filter detected spam

Remember, Mm and Cc uses those fields in the SOP structure to find their
own data structures for that file instance. So, two file objects that
point to the same SOP are the same file, but in addition, if you have
two file objects with different SOP structures, but the SAME data values
(section object or cache map) then the corresponding OS component is
going to try and follow those links.

The other way this would manifest is a nice crash much later when the
original copy had been torn down but you caused something to follow the
second link!

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Amitabh Mathrawala
Sent: Wednesday, April 20, 2005 1:14 PM
To: ntfsd redirect
Subject: RE: [SPAM] - Re: [ntfsd] No IRP_MJ_READ if I use ZwCreateFile -
Bayesian Filter detected spam

Aha ! The code retrieves the file object for the file mapping for file
‘y’ and assigns it’s SectionObjectPointer->DataSectionObject to the
corresponding field in the file object for file ‘x’. Hopefully that
solves the mystery. If so, thanks a lot for helping me see the light.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Wednesday, April 20, 2005 10:01 AM
To: Windows File Systems Devs Interest List
Subject: RE: [SPAM] - Re: [ntfsd] No IRP_MJ_READ if I use ZwCreateFile -
Bayesian Filter detected spam

What are you setting in your file object’s Section Object Pointers
structure?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Amitabh Mathrawala
Sent: Wednesday, April 20, 2005 12:53 PM
To: ntfsd redirect
Subject: RE: [SPAM] - Re: [ntfsd] No IRP_MJ_READ if I use ZwCreateFile -
Bayesian Filter detected spam

Actually, I realized I may not have done a great job explaining the
problem. Let me try again :
Notepad sends an irp_mj_create for a file named ‘x’ on the remote
machine down to my file system redirector (implements a pseudo file
system, in OSR’s language).
While processing the irp_mj_create, I open a file named ‘y’ on the local
disk and complete the irp for file ‘x’.
After that, I expect an irp_mj_read for the file named ‘x’ which never
comes in.
I just found out a workaround for this but I am still trying to
understand how this works. Somewhere in the code,before I complete the
irp_mj_create, I was creating a section for the file ‘y’ (for my own
memory mapping purposes). When I remove this memory mapping, I get the
irp_mj_reads as expected.

I guess I am trying to understand why would notepad’s memory mapping for
file ‘x’ refer to memory mapping for file ‘y’ ? In other words, how does
the IOmanager know that file 'x’s contents are really in the memory map
for file ‘y’ ?

Thanks a lot for your replies.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S.
Shatskih
Sent: Tuesday, April 19, 2005 7:15 PM
To: Windows File Systems Devs Interest List
Subject: [SPAM] - Re: [ntfsd] No IRP_MJ_READ if I use ZwCreateFile -
Bayesian Filter detected spam

Notepad uses memory-mapped files. So, monitor the noncached reads.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Amitabh Mathrawala”
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, April 19, 2005 10:18 PM
Subject: [ntfsd] No IRP_MJ_READ if I use ZwCreateFile

Hi Folks !

I am having an issue that might have been discussed long before but I
can’t seem to find it in the old posts.

I am writing a FSD (part of a pseudo file system) that calls
ZwCreateFile to open a file from the local disk when it gets an
IRP_MJ_CREATE. If Notepad is the application that sends the create irp
and while processing the irp if I call ZwCreateFile, then I don’t see
IRP_MJ_Reads from Notepad, but the file opens up with it’s encrypted
contents. I need those IRP_MJ_Reads so that I can decrypt the file. I
know that notepad uses memory mapped files which could be the reason
don’t see the irp_mj_reads. Is there anything I can do to get the
IRP_MJ_Reads from Notepad ?

I have tried specifying FILE_NO_INTERMEDIATE_BUFFERING in ZwCreateFile
but that didn’t make the difference. Please send me some suggestions or
point me in the right direction. I absolutely need to understand what’s
going on here.

Here are some specifics :

ZwCreateFile (&cache, FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,
&attr, &iosb, 0, FILE_ATTRIBUTE_HIDDEN, FILE_SHARE_READ |
FILE_SHARE_READ | FILE_SHARE_DELETE, FILE_OPEN_IF, options |
FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_ALERT, NULL, 0);

Thanks.

Amitabh Mathrawala | xxxxx@viack.com | 425 605 7483


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@viack.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com