Unexpected data read

[DenisAnisimov]

Some code:

const
  DontChange: TFileTime = (dwLowDateTime: $FFFFFFFF; dwHighDateTime: $FFFFFFFF);

Handle := CreateFile('E:\test.dat',
  GENERIC_READ or GENERIC_WRITE,
  FILE_SHARE_READ or FILE_SHARE_WRITE,
  nil,
  OPEN_EXISTING,
  FILE_ATTRIBUTE_NORMAL,
  0);
if Handle <> INVALID_HANDLE_VALUE then
  begin
    SetFileTime(Handle, nil, @DontChange, @DontChange);
    WriteFile(Handle, Data, SizeOf(Data), Written, nil);
    CloseHandle(Handle);
  end;

It modifies the file without changing the last modification date or last access date. It works correctly with NTFS. But when working with Docany I see the following sequence of callbacks:

  CreateFile started
    CreateFile in AFileName=\test.dat
    CreateFile in ADesiredAccess=FILE_READ_DATA/FILE_LIST_DIRECTORY, FILE_WRITE_DATA/FILE_ADD_FILE, FILE_APPEND_DATA/FILE_ADD_SUBDIRECTORY/FILE_CREATE_PIPE_INSTANCE, FILE_READ_EA, FILE_WRITE_EA, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, READ_CONTROL, SYNCHRONIZE
    CreateFile in AFileAttributes=FILE_ATTRIBUTE_NORMAL
    CreateFile in AShareAccess=FILE_SHARE_READ, FILE_SHARE_WRITE
    CreateFile in ACreationDisposition=FILE_OPEN
    CreateFile in ACreateOptions=FILE_SYNCHRONOUS_IO_NONALERT, FILE_NON_DIRECTORY_FILE
    CreateFile --------
    CreateFile in GenericDesiredAccess=GENERIC_WRITE, GENERIC_READ
    CreateFile in FileAttributesAndFlags=FILE_ATTRIBUTE_NORMAL
    CreateFile in CreationDisposition=OPEN_EXISTING
    CreateFile in AShareAccess=FILE_SHARE_READ, FILE_SHARE_WRITE
    CreateFile out Result=STATUS_SUCCESS
  CreateFile finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  ReadFile started <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< what is it?
    ReadFile in AFileName=\test.dat
    ReadFile in ABufferLength=32768
    ReadFile in AOffset=0
    ReadFile out AReadLength=32768
    ReadFile out Result=STATUS_SUCCESS
  ReadFile finished
  ReadFile started <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< what is it?
    ReadFile in AFileName=\test.dat
    ReadFile in ABufferLength=12288
    ReadFile in AOffset=32768
    ReadFile out AReadLength=10111
    ReadFile out Result=STATUS_SUCCESS
  ReadFile finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  SetFileAttributes started
    SetFileAttributes in AFileName=\test.dat
    SetFileAttributes in AFileAttributes=
    SetFileAttributes out Result=STATUS_SUCCESS
  SetFileAttributes finished
  SetFileTime started
    SetFileTime in AFileName=\test.dat
    SetFileTime in ACreationTime=01.01.1601
    SetFileTime in ALastAccessTime=$FFFFFFFFFFFFFFFF
    SetFileTime in ALastWriteTime=$FFFFFFFFFFFFFFFF
    SetFileTime out Result=STATUS_SUCCESS
  SetFileTime finished
  WriteFile started
    WriteFile in AFileName=\test.dat
    WriteFile in ANumberOfBytesToWrite=16
    WriteFile in AOffset=0
    WriteFile out ANumberOfBytesWritten=16
    WriteFile out Result=STATUS_SUCCESS
  WriteFile finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  GetFileInformation started
    GetFileInformation in AFileName=\test.dat
    GetFileInformation out Result=STATUS_SUCCESS
  GetFileInformation finished
  ReadFile started <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< what is it?
    ReadFile in AFileName=\test.dat
    ReadFile in ABufferLength=4096
    ReadFile in AOffset=0
    ReadFile out AReadLength=4096
    ReadFile out Result=STATUS_SUCCESS
  ReadFile finished
  Cleanup started
    Cleanup in AFileName=\test.dat
  Cleanup finished
  CloseFile started
    CloseFile in AFileName=\test.dat
  CloseFile finished

For some reason Docany does an unnecessary read which in turn changes the last access dates. And as a result, the code does not work correctly. Who is the initiator of this reading? If Docany itself, then is it possible to somehow determine inside my handler that Docany is doing its own service reading, so as not to change the access date?

[Liryna]

Hi @DenisAnisimov ,
You can use Procmon to see who is issuing the read or lookup to processId from the DokanFileInfo that is given as parameter.
Dokan is not doing anything but just forwarding requests from applications on the system. For example, Explorer reads files to generate previews, antivirus often read content before the original app reader etc. It is not correct to expect only one app will access the file.

[DenisAnisimov]

processId from the DokanFileInfo

Thanks for the hint. It was Windows Defender.