If the file is not opened before your filter is loaded, you should be seeing the paging read used to bring this data into the cache. Note that it is possible to see the paging read *before* the user’s read occurs. The system cache has a read-ahead mechanism that will try to detect read access patterns and prefetch the data from disk. These IOs also look like paging reads, so you should see them.
If you modify the memory pages outside of the paging read path, these pages will be tracked as dirty by the memory manager and the mapped page writer will try to flush these pages back to disk. From your description of what you are trying to do, I think you can do all your data modifications in the paging read path, so this may not be an issue for you.
Molly Brown
Microsoft Corporation
This posting is provided “AS IS” with no warranties and confers no rights.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pablo G. Frank
Sent: Wednesday, December 17, 2003 9:01 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Still trying to trap Notepad and command prompt copy activity
Hi, Alexei.
Thanks, very much, for your comments.
You’re right. I need to modify data on reads. But before that, I need to find a way to get a paging io read. By now, no paging io read is requested for that file, as the file is paged when written (see my last email some minutes ago). I would appreciate any suggestion.
Also, files are read only, so I don’t need to map the data on write.
Best regards.
Pablo Frank.
“Alexei Jelvis” escribi? en el mensaje news:xxxxx@ntfsd…
>
> The problem with your approach is that data in cache is unmodified.
> This allow programs like notepad that use memory mapping to access
> contents of the file to see unmodified data.
> What you need to do is to modify data on the way from disk to memory, i.e.
> modify data for IRP that has IRP_NOCACHE flag. Cache reads as well as
> FastIoRead will return already modified data from cache, you don’t
> need to modify data for cache reads.
> Obviously you need to make sure that when data is being written from
memory
> to disk the opposite conversion occur.
>
> Alexei.
>
> “Pablo G. Frank” wrote in message
news:xxxxx@ntfsd…
> >
> > Hi:
> >
> > I know that a lot has been discussed about notepad and how to trap
> > its activity, but I can’t do that at all. The same happens with the
> > command prompt copy command:
> >
> > - I’m developing a FSFD for WXP
> > - I started my driver from the filespy sample from the IFS Kit
> > - I read the “Tracking State and Context - Reference Counting…”
article
> > - I implemented the per-stream file context using
> FsRtlInitPerStreamContext
> > and FsRtlInsertPerStreamContext
> > - I prepare a special folder (let’s call it “Virtual” folder) where
> > I
add
> > files (“Test1.txt”, “Test2.txt”, etc.)
> > - When one of this files is read or query information, I replace the
> > original information with my own, so
> >
> > To match the files:
> > - I insert the context information using FsRtlInsertPerStreamContext
> > on IRP_MJ_CREATE completion
> > - I check the FileObject using FsRtlLookupPerStreamContext to see if
it’s
> > one the the “Virtual” files
> >
> > When Matched:
> > - I modify the file size information in IRP_DIRECTORY_CONTROL
> > completion
> > - I modify the file size information in IRP_MJ_QUERY_INFORMATION for
> > FILE_STREAM_INFORMATION, FILE_STANDARD_INFORMATION and
> FILE_ALL_INFORMATION
> >
> > At this point, the size modification works perfectly. I always see
> > the
> size
> > I modified and not the real one
> >
> > Also when matched:
> > - I modify the file content at the IRP_MJ_READ completion when
> > METHOD_NEITHER
> > - I modify the file content at FastIoRead
> >
> > I don’t get any IRP_MJ_READ for the “virtual” files other than
> > METHOD_NEITHER. I don’t get any IRP_PAGING_IO flagged IRP_MJ_READ
> > for
the
> > “Virtual” files.
> >
> > At this point, I can open “test1.txt”, “test2.txt”, etc. files with
> > Word
> or
> > Excel and I get the right (virtual, provide by me) size and content.
> >
> > But when I copy the file using windows explorer or the command
> > prompt
copy
> > command, or when I open the file with Notepad, I get the real,
unmodified
> > original content, thought the size is modified (and filled with
> > blanks
if
> > bigger)
> >
> > Can anybody give me some help?. I was working on this program for
> > more
> than
> > a month, and I solved all the problems, but this one is completely
> > reluctant.
> >
> > Thanks in Advance
> >
> > Pablo Frank
> >
> >
> >
> >
>
>
>
>
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com