why wordpad.exe clear all file content?

NTFSD
1

Hi All:
I am developing file system filter driver, there is a write control function
in my filter driver. Refuse some processes include wordpad.exe writing some
files. For example, there is a text file named test.txt contains some
characters, I open this text file using wordpad.exe, then I modify some
characters, and I try to save this file, obviously the save operation will
be refuse by my filter driver, at the end, I close wordpad.exe, wordpad.exe
prompt to save the file, I choose NO and quit the wordpad.exe. But this time
I find that the test.txt file size become zero and contains nothing. I don’t
know which process and why clear this file. But it is working order when I
do those operations using notepad.exe.

Any suggestions are welcome!
Thanks.

2

> Refuse some processes include wordpad.exe writing some files.

Pointless idea…

Don’t for get that, in addition to WriteFile(), a process can modify a file via file mapping. This is what most
word processors normally do, and there is no guarantee that paging write will be done in context of a target process - it may well happen in context of mapped page writer as well…

I don’t know which process and why clear this file.

I believe this is Memory Manager’s trick - apparently, it responds to your actions with truncating a section…

Anton Bassov

3

You must not fail writes.

To write-protect a file, fail MJ_CREATE with WRITE_DATA in DesiredAccess
with STATUS_ACCESS_DENIED or so.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

“liao_jh” <liao_jh> wrote in message news:xxxxx@ntfsd…
> Hi All:
> I am developing file system filter driver, there is a write control function
> in my filter driver. Refuse some processes include wordpad.exe writing some
> files. For example, there is a text file named test.txt contains some
> characters, I open this text file using wordpad.exe, then I modify some
> characters, and I try to save this file, obviously the save operation will
> be refuse by my filter driver, at the end, I close wordpad.exe, wordpad.exe
> prompt to save the file, I choose NO and quit the wordpad.exe. But this time
> I find that the test.txt file size become zero and contains nothing. I don’t
> know which process and why clear this file. But it is working order when I
> do those operations using notepad.exe.
>
> Any suggestions are welcome!
> Thanks.
>
>
></liao_jh>