hi,
I use SwapBuffer sample to XOR data before reading and writing.
The problem is when data Xor’ed in IRP_MJ_WRITE, this data cached and the notepad use cached data in reading.
So no IRP_MJ_READ called and I think data readed from cache (XOR data).
I want to clear cache in post Writeing. Or any way to solve this problem.
I also know that, the MMF is not my problem on no calling IRP_MJ_READ.
tanks for any recommendation
Notepad uses memory-mapped files. Cache and mapped files are supported by the same resident pages.
Not possible on Windows. You can purge a cache for a file if there is no mapped data sections( i.e. memory mapped file ), but this requires to synchronize with a file system driver and each file system has its own rules for this.
Windows lacks reverse mapping and unable to invalidate all PTEs for a particular resident page, that makes cache purging impossible in presence of a memory-mapped file data. Windows Memory Manager periodically trims resident pages set for each process thus invalidating PTEs and releasing physical pages.
> jack jahan wrote:
I want to clear cache in post Writeing. Or any way to solve this problem.
Use NtSetSystemInformation with SystemMemoryListInformation (0x50).
It requires at least Windows Vista and SE_PROF_SINGLE_PROCESS_NAME privilege enabled.
The RAMMap Sysinternals utility uses this method to purge system cache.
tanks a lot for yours recommendations…
I noticed to another solution.
Can I set in pre write for no caching write?
Or
Can I set in pre read for no read from cache?
You can set IRP_NOCACHE flag but file system driver doesn’t have to acknowledge this non cached IO, it still can use cache for IO. NTFS does this for compressed files.
my options for solve this problem are:
1- purge cache after any write : bad performance
2- disable read behind : it may by not affected and file system don’t care it.
3- disable lazy write : it may by not affected and file system don’t care it.
4- change parameter in IRP_MJ_CREATE : such 2,3
5- …
if purge cache is only safe solution, then is any sample code for Mj_write
my file system is NTFS, and OS is Win 7+
First of all this will not work in all cases. Read again what I told about cache purging in presence of memory mapped files. Second it is dangerous as calling CcPurgeCacheSection from a filter conflicts with file system driver as it requires synchronization - you should reverse engineer the underlying FSD to find this. You can play with CcFlushCache followed by CcPurgeCacheSection but you have been warned.
You already know this will not work smoothly.
Irrelevant to your task.
NTFS might ignore non cached IO flags. Also, non cached IO should be aligned so either buffer replacement or new IRP is required.
Should have been - “The Isolation Driver” http://www.osronline.com/article.cfm?article=560 and http://www.osronline.com/article.cfm?article=571
I think the other solution (5-…) also can be :
If we want to solve problem of reading cipher data by caching it in write operation,
in post write we can dirty the pages in cache. then any read from cache failed and OS read data from device 
IS this way can be applicable?
if yes, how we can dirty goal pages in post write?
my first idea is write same cipher data by FltWriteFile (no caching config) in post write.
but this can be bad performance.
tank you for any recommendation…
This is not how the cache works. If you somehow wipe the file cache metadata the related pages are still resident and related data segment and control area are still valid and connected to a file object. So on next cached read or write the cache metadata will be recreated and these pages will be associated with it.