EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Intercepting SetFilePointer

Posted: 01/01/2013 11:48:15
by Vishnu Venkatesh (Basic support level)
Joined: 12/27/2012
Posts: 19

Hi - the user app (not the user app for CallbackFilter) uses SetFilePointer() to go to the beginning of the file. I have embedded characters before the actual data that I would like the user app to "skip". When SetFilePointer() is called with FILE_BEGIN, no events seem to be fired at the callback filter level.

Is there a way to intercept the SetFilePointer() call?

Posted: 01/02/2013 08:37:33
by Vladimir Cherniga (Team)

The requested operation may be optimized to not use irp packets. When file handle used in SetFilePointer is opened for synchronous non-buffered operations, file pointer may be changed directly in user mode and it will not trigger IRP_SET_INFORMATION request in kernel mode. Anyway you may simply check the status of operations using ProcMon utility from sysinternals.com and look what type of requests triggered by the target win32 api.



Topic viewed 1737 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS business operates as a division of /n software, inc. For more information, please read the announcement.

Got it!