Hello Everyone
FLT_PREOP_CALLBACK_STATUS PreReadCallback(
_Inout_ PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_opt_ PVOID CompletionContext
)
{
ULONG flag = Data->Iopb->IrpFlags;
KdPrint(("Pre Read"));
if (FlagOn(IRP_NOCACHE, flag)) {
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
if (FlagOn(IRP_PAGING_IO, flag)) {
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
if(FlagOn(IRP_SYNCHRONOUS_PAGING_IO, flag)) {
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}
FLT_POSTOP_CALLBACK_STATUS
PostReadCallback(
_Inout_ PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_opt_ PVOID CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS Flags
)
{
UNREFERENCED_PARAMETER(Flags);
UNREFERENCED_PARAMETER(CompletionContext);
UNREFERENCED_PARAMETER(FltObjects);
if (!NT_SUCCESS(Data->IoStatus.Status) || Data->IoStatus.Information == 0 || Data->Iopb->Parameters.Read.ReadBuffer == NULL) {
return FLT_POSTOP_FINISHED_PROCESSING;
}
PUCHAR buffer = (PUCHAR)Data->Iopb->Parameters.Read.ReadBuffer;
ULONG bytesRead = (ULONG)Data->IoStatus.Information;
CHAR dummy[] = "This is dummy content";
SIZE_T toCopy = min(sizeof(dummy) - 1, bytesRead);
RtlCopyMemory(buffer, dummy, toCopy);
Data->IoStatus.Information = (ULONG)toCopy;
return FLT_POSTOP_FINISHED_PROCESSING;
}
Sorry for asking this repeatedly but i saw some inactivity.
Is this the way (Code) Aditya mentioned Handling Paging IO Read change actual data on disk in this post, to handle memory mapped file. While this is not working for me, can you give suggestion or any pseudo code.