Hi, I write a dispatch function for write major function. in my function I print the number of bytes writed to a file. I see that after each write (for example 30 byte) I receive irp that write size is 4096 (it doesn’t change the file content). How can I distinguish between two irp and know which one really change the file content?
I would guess that the first write is the cached write, it is destined
for the cache manager via the underlying file system. Then the second
write is probably the paging write which is destined for the disk. So it
depends on what you mean by changing the file content. The first write
would modify the contents in the system cache whereas the second write
would change the content on disk. You can distinguish these by looking
at the Irp Flags and checking for the PAGING flag.
This is a fundamental concept for the workings of the IO pathways so I
would suggest grabbing a book or taking a class to gain a better
understanding of how this works. It will save you lots of time and head
ache.
Pete
On 4/12/2013 11:28 PM, xxxxx@yahoo.com wrote:
Hi, I write a dispatch function for write major function. in my function I print the number of bytes writed to a file. I see that after each write (for example 30 byte) I receive irp that write size is 4096 (it doesn’t change the file content). How can I distinguish between two irp and know which one really change the file content?
NTFSD is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295