Why FltReadFile return STATUS_END_OF_FILE?

NTFSD
1

Hi all.
Can someone answer to me this question?
I’ve a file with file size is 2bytes.I’m using FltReadFile to read file content but bytes read returns 0 and status = STATUS_END_OF_FILE.Im using it at Pre-Write callback.

And in pre-write,im checking NON-CACHE with FlagOn(IRP_NOCACHE, pIopb->IrpFlags) but it’s always return FALSE , post-create i’ve set FILE_NO_INTERMEDIATE_BUFFERING in FltCreateFile function.Why?
Thank so much.

Best Regards
AT

2

Kinda obvious, but what offset are you specifying? And it’s not obvious
which file object you are using to send the read down on…

And in pre-write,im checking NON-CACHE with
FlagOn(IRP_NOCACHE, pIopb->IrpFlags) but it’s always return FALSE ,
post-create i’ve set FILE_NO_INTERMEDIATE_BUFFERING in
FltCreateFile function.Why?

I’m afraid I don’t understand your question. If you set
FILE_NO_INTERMEDIATE_BUFFERING, it will not have any effect. And where/when
are you calling FltCreateFile?

wrote in message news:xxxxx@ntfsd…

Hi all.
Can someone answer to me this question?
I’ve a file with file size is 2bytes.I’m using FltReadFile to read file
content but bytes read returns 0 and status = STATUS_END_OF_FILE.Im using it
at Pre-Write callback.

And in pre-write,im checking NON-CACHE with FlagOn(IRP_NOCACHE,
pIopb->IrpFlags) but it’s always return FALSE , post-create i’ve set
FILE_NO_INTERMEDIATE_BUFFERING in FltCreateFile function.Why?
Thank so much.

Best Regards
AT

3

Thank Rod,
I’ve minifilter to encryption/decryption.
Ex: My file size is 100bytes.At pre-write, Parameters.Write.Length = 8 .I want to read 16bytes to encrypt.But I cant.

I saw in pre-write,the first write,file size is zero,the second write,filesize = written length of the first write.

How do i do to read file file with size that i expected .or get file size when file modified at IRP_MJ_WRITE.
Thanks

Best Regards
AT