First of all, this is not about memory mapped file.
I implemented minifilter driver from ms minifilter sample "swapbuffer". And successfully swapped some specific data when IRP_MJ_WRITE is passed in. But when the system cache is emptied (i.e, reboot) all swapped buffer was not applied to the file. I checked right after buffer swapped and It was perfectly swapped. But after I empty the system cache, Its gone. How is this possible? Minifilter driver can't change anything to the buffer to write on disk?
I dont know exactly but I can guess that this is about the windows cache and memory manager. But must it apply the swapped content when its cache is being empty? Im gonna read the book "NT file system internal" to find out, but anyone in here may be able to show me the the reason.
Now I can tell for sure. The reason why I failed to alter the buffer contents was my stupid encryption algorithm plus my ignorance about cache manager. When I copy the file, writing operation occurs twice. To physical disk, and to the cache. I dont know which one comes first yet. :p My encryption algorithm was just simply doing bit wise operation. So if it does that twice, its just decrypted plain text. That was the problem. So I altered code to encrypt on irp that writes to physical disk, IRP_NOCACHE, it works as I meant it would be.
U wont even imagine how I hated myself for this stupidity. Tons of articles were aleady on Osr.