Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 5  
04 Aug 17 06:55
tim o'brain
xxxxxx@gmail.com
Join Date: 28 Jul 2017
Posts To This List: 4
How is it posssible that i dont see my file name in preread callbeck?

I made minifilter with pre and post read callbackes when i open file i don see any call with my file name (i clean the cash before i opened the file so i'ts can't be becoase of this) , but when i save something in the file i see the file name (in pre read and post read callback). i add this dbg print that will make my question clearer: this is ALL the cals from the moment i double click on "new_check_buffer.txt: file till it's opened and i can read it: [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf- ms [-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514 .cdf-ms ParentDir:\Windows\winsxs\FileMaps\ Stream:(null) FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms [-]SwapPreReadBuffers \Device\HarddiskVolume1\Users\pit\Desktop\desktop.ini [-info-] Name:\Device\HarddiskVolume1\Users\pit\Desktop\desktop.ini ParentDir:\Users\pit\Desktop\ Stream:(null) FinalComponent:desktop.ini [-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\Fonts\StaticCache.dat [-info-] Name:\Device\HarddiskVolume1\Windows\Fonts\StaticCache.dat ParentDir:\Windows\Fonts\ Stream:(null) FinalComponent:StaticCache.dat this is the calls when i hit ctrl + s: [+] SwapPreReadBuffers file name \Device\HarddiskVolume1\Users\pit\Desktop\new_check_buffer.txt [+] postRead file name \Device\HarddiskVolume1\Users\pit\Desktop\new_check_buffer.txt [*] SwapPostReadBuffersWhenSafe now i don't get it , it's have to be that there is SOME read call for the ability to open and read txt file so how come i don't see it? and why i do see read callback dbg printing on save operation??? Thank you pit
  Message 2 of 5  
04 Aug 17 08:20
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 253
How is it posssible that i dont see my file name in preread callbeck?

I guess you don't have an IRP_MJ_CREATE callback in the FLT_OPERATION_REGISTRATION array.
  Message 3 of 5  
04 Aug 17 09:07
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 253
How is it posssible that i dont see my file name in preread callbeck?

Regarding read callback. In case of memory mapped IO a read request is not sent to FSD if pages with file data are resident ( i.e. in Active or Standby state ). You might have attached the filter after a file has been cached. If you write a file after attaching the filter the file data was saved in the cache which shares pages with memory mapped section.
  Message 4 of 5  
06 Aug 17 13:31
tim o'brain
xxxxxx@gmail.com
Join Date: 28 Jul 2017
Posts To This List: 4
How is it posssible that i dont see my file name in preread callbeck?

so i need to force the file system to not cache the I/O ? How do i do it? p.s. i cleared the cache after installing the minifilter and before i opened the txt file , isn't that enagh to force the file system go throgh the minifilter for reading the content of the file? thank you pit
  Message 5 of 5  
06 Aug 17 14:59
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 253
How is it posssible that i dont see my file name in preread callbeck?

<QUOTE> so i need to force the file system to not cache the I/O ? How do i do it? i cleared the cache after installing the minifilter and before i opened the txt file , isn't that enagh to force the file system go throgh the minifilter for reading the content of the file? </QUOTE> You can't do this in a reliable way. Some file system flush and purge pages( that is what you need ), others just flush so pages remain resident. Also, it is not possible to purge pages if user mappings for a file exist. File system drivers use the old purge interface that can't do this( i.e. unmap virtual to physical mappings in a user process to purge pages ). Anyway, even with the new interface there is a race condition so pages can be brought back on requests from a user process that maps a file into memory.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 07:09.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license