Dear all, it has been a long time since I asked the last question few months ago.
Now I encounter a new problem:
I build an encryption filter driver with Isolation Filter framework, my filter driver maintains the memory/cache for white-list programs, and the programs-not-in-white-list just use the memory/cache of system, this design just worked well for most scenes. But for notepad.exe, my filter driver went into a wrong way, after writing some text and save the file, I found that the content in the file doesn’t changed(I’m quite sure I have changed the content of that txt).
In order to guarantee that programs-not-in-white-list can get the right and up-to-date data, I think my filter driver should flush the memory mapped files into the disk, but I didn’t find a way to do so, is there any functions could flush the memory mapped files into the disk?
Read the archives, there is no way to guarantee a flush. Welcome to the
challenges of encryption drivers.
Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@serpurity.com
Sent: Monday, March 20, 2017 1:48 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to flush memory mapped files?
Dear all, it has been a long time since I asked the last question few months
ago.
Now I encounter a new problem:
I build an encryption filter driver with Isolation Filter framework, my
filter driver maintains the memory/cache for white-list programs, and the
programs-not-in-white-list just use the memory/cache of system, this design
just worked well for most scenes. But for notepad.exe, my filter driver went
into a wrong way, after writing some text and save the file, I found that
the content in the file doesn’t changed(I’m quite sure I have changed the
content of that txt).
In order to guarantee that programs-not-in-white-list can get the right and
up-to-date data, I think my filter driver should flush the memory mapped
files into the disk, but I didn’t find a way to do so, is there any
functions could flush the memory mapped files into the disk?
—
NTFSD is sponsored by OSR
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:
To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:>
If your driver maintains( i.e. initializes ) file objects then CcFlushCache is your friend as it calls MmFlushSection even for non-cached files ( i.e. mapped but not cached ), if the file is mapped and cached then the cache is supported by the same pages as the mapped virtual address range. Do not forget about proper synchronization before calling CcFlushCache.
If your driver doesn’t maintain file objects and uses file objects initialized by FSD(file system driver) it is attached to then there is no common way to do this. You can play with IRP_MJ_FLUSH_BUFFERS or you can use CcFlushCache, in the latter with a risk of going into conflict with FSD and MM( Memory Manager ) as you will be unable to properly synchronize with FSD before calling CcFlushCache.