Hi, I’m developing a driver based on minifilter.
Now I want to get the thread do the paging_io operation(mainly IRP_MJ_WRITE), I found that mostly the program itself do the paging_io operation(such as notepad.exe, winword.exe).
But I think sometimes system:4 will do the paging_io operation, right?
Eh…I mean can I treat the thread I get as the thread really start the write operation?
Paging writes can come in under the same thread as the initial IO
operation or it can come in under the system thread such as the cache
and memory mgr worker threads.
Are you simply trying to capture paging IO operations in general? Why
not associate a stream context to the file at the time of open then just
look for the PAGING_IO flag in the request? Or if you don’t care about
anything regarding the file itself, such as the file name, then simply
look for the PAGING_IO flag in the request data.
Pete
On 8/24/2014 9:53 AM, xxxxx@serpurity.com wrote:
Hi, I’m developing a driver based on minifilter.
Now I want to get the thread do the paging_io operation(mainly IRP_MJ_WRITE), I found that mostly the program itself do the paging_io operation(such as notepad.exe, winword.exe).
But I think sometimes system:4 will do the paging_io operation, right?
Eh…I mean can I treat the thread I get as the thread really start the write operation?
NTFSD is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
It’s really a good advice.
I have achieve my function in that method.
Thank you so much! 