Cannot get the latest TCMD FileInfo plugin to work on Win9x

[jaclaz]

Vivere e sovvravivere non sono la stessa cosa.

But - just like getting old - the alternative is worse

Old age isn't so bad when you consider the alternative.

jaclaz

[Drugwash]

To be honest, I wouldn't be so sure. I'd rather die before my pants get brown in the rear too often.

[rloew]

It wouldn't be hard to add this function.

Probably. Just needs a safety check for results that overcome the max FAT32 size that could be read through network from a NTFS partition. I'm not sure how the plug-in, OS, etc would react when such large result is returned, under Win9x.

Is there any more activity in the KernelEx department? Haven't seen any update at Leyok's repository in quite some time. Is there any other attempt known?

Reading a File Size under Windows 9x from a NTFS Partition through a Network shows the true size, but there is no way to access more than 4GiB even with my Large File Emulator to receive the data.

I would assume that any program that uses GetFileSizeEx would be able to deal with reported sizes above 4GiB, although they may not realize that they cannot be fully accessed.

[Drugwash]

In this particular case (the FileInfo TC plug-in), only the file headers are being retrieved from the actual file, not the entire file, so there may not be any problem^[1]. Although the plug-in has the ability to disassemble the analyzed file (if the corresponding option is enabled in its .ini file), hopefully nobody would attempt to do that on a 4GB+ file. I have no idea if there is any hardcoded filesize limit for the Disassemble option in this plug-in.

Now, if we consider the implementation of GetFileSizeEx() in KernelEx, obviously other applications may use it and there's a chance they may actually try to perform operations on those files (copy/move/edit). How could we best handle the situation, when files larger than 4GB are being accessed over the network: should KernelEx's GetFileSizeEx() return an error, should it return the full size or should it return the maximum allowed FAT32 size, thus fragmenting the file? I suppose the latter - although possible - would be unfair and possibly dangerous. But the others would also produce an error in the application and it would all depend on how errors are handled by each application. So probably the best solution would be to return the full size and let the application deal with the impossibility of handling the file; if the value is for display only, then it better be accurate.

¹. There may be problems with setting/moving/getting file pointer when reading from the end of the file though.

[rloew]

In this particular case (the FileInfo TC plug-in), only the file headers are being retrieved from the actual file, not the entire file, so there may not be any problem^[1]. Although the plug-in has the ability to disassemble the analyzed file (if the corresponding option is enabled in its .ini file), hopefully nobody would attempt to do that on a 4GB+ file. I have no idea if there is any hardcoded filesize limit for the Disassemble option in this plug-in.

Now, if we consider the implementation of GetFileSizeEx() in KernelEx, obviously other applications may use it and there's a chance they may actually try to perform operations on those files (copy/move/edit). How could we best handle the situation, when files larger than 4GB are being accessed over the network: should KernelEx's GetFileSizeEx() return an error, should it return the full size or should it return the maximum allowed FAT32 size, thus fragmenting the file? I suppose the latter - although possible - would be unfair and possibly dangerous. But the others would also produce an error in the application and it would all depend on how errors are handled by each application. So probably the best solution would be to return the full size and let the application deal with the impossibility of handling the file; if the value is for display only, then it better be accurate.

¹. There may be problems with setting/moving/getting file pointer when reading from the end of the file though.

GetFileSize already returns the full size so GetFileSizeEx should also.

If I implement it with DLLHOOK, I would pass the results through unmodified.

You cannot get, set, or move a File pointer beyond 4GiB-1 from Windows 9x through a Network.

[Drugwash]

Just as I thought. Thank you.