CBFS Filter 2020 C++ Builder Edition

Questions / Feedback?

NotifyWriteFile Event

Fires when data has been written to a file.

Syntax

typedef struct {
  String FileName;
  __int64 Position;
  int BytesToWrite;
  int Direction;
  int BytesWritten;
  int Status;
  int ResultCode;
} TcbfCBMonitorNotifyWriteFileEventParams;

typedef void __fastcall (__closure *TcbfCBMonitorNotifyWriteFileEvent)(System::TObject* Sender, TcbfCBMonitorNotifyWriteFileEventParams *e);

__property TcbfCBMonitorNotifyWriteFileEvent OnNotifyWriteFile = { read=FOnNotifyWriteFile, write=FOnNotifyWriteFile };

Remarks

This event fires when data has been written to the file specified by FileName.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_NE_WRITE flag.

The Position parameter reflects the byte offset in the file at which writing started. A value of -1 means "append to the end of the file".

The BytesToWrite parameter reflects how many bytes were to be written to the file.

The Direction parameter indicates the request direction; please refer to the Cached and Non-Cached Requests topic for more information. Possible values are:

FS_REQUEST_DIR_USER_NONCACHED0Operations performed in the 'user mode application <--> filesystem' direction.
FS_REQUEST_DIR_USER_CACHED1Operations performed in the 'user mode application <--> system cache' direction.
FS_REQUEST_DIR_SYSTEM_NONCACHED2Operations performed in the 'system cache <--> filesystem' direction.
FS_REQUEST_DIR_SYSTEM_CACHED3Operations performed in the 'system component <--> system cache' direction.

The BytesWritten parameter reflects how many bytes were actually written to the file.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the NtStatusToWin32Error method. Please note that this event won't fire for failed requests unless the ProcessFailedRequests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error. Note, however, that this event fires after the operation has already completed, so reporting an error won't actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

 
 
Copyright (c) 2020 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 C++ Builder Edition - Version 20.0 [Build 7543]