No, it queries through the known kernel interfaces, there are no others.
Know that this is workable, many people on this list have completed what
you are doing successfully so there is something wrong with your
implementation.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: “xxxxx@gmail.com” To: “Windows File Systems Devs Interest List” Sent: 9/23/2017 12:09:47 AM Subject: RE:[ntfsd] minifilter failed to read encrypted ppt file
>Are you mean IRP_MJ_QUERY_INFORMATION callback or >IRP_MJ_DIRECTORY_CONTROL? > >— >NTFSD is sponsored by OSR > > >MONTHLY seminars on crash dump analysis, WDF, Windows internals and >software drivers! >Details at http: > >To unsubscribe, visit the List Server section of OSR Online at >http:</http:></http:>
As the filesystem is implemented entirely in KM, it would be impossible for Office applications in UM to get the file size without a KM interaction of some kind.
This is a fundamental question and if you are asking it you have lot?s to learn.
Now if you are asking is there some way for a UM application to get the file size besides the one(s) that I am filtering, then the answer might be yes. Unfortunately, my mail client misses about half of the messages on this form (which is very frustrating), so I?m not exactly sure what you are doing or what flaws might exist in your logic
From: xxxxx@gmail.commailto:xxxxx Sent: September 23, 2017 9:35 AM To: Windows File Systems Devs Interest Listmailto:xxxxx Subject: RE:[ntfsd] minifilter failed to read encrypted ppt file
It’s possible that office query file size in ways which aren’t in kernel mode? can you give me an example of these ways?
— NTFSD is sponsored by OSR
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at http:
To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></mailto:xxxxx></mailto:xxxxx></https:>
>Now if you are asking is there some way for a UM application to get the file size besides the one(s) that I am filtering, then the answer might be yes.
No, I don’t want a UM application. Peter said “Office tools have a way of querying the file size in different ways and comparing them to ensure the file saved correctly.” and i guessed may be there are relations with user mode APIs.