File edits not changing file status

doubledeej

What would I look for in procmon?

It’s difficult for me to give any more steps to replicate. It now happens every single time on my system now. I can’t get it to not misbehave.

I’m currently running version 7.8.5, 32-bit version on Windows 10 Enterprise 64-bit in an Active Directory environment (yes, I run AD at home). AMD Ryzen 9 3950X processor, 64 GB of RAM, 21 TB of storage (5 TB in SSDs, 16 TB HDDs), nVidia RTX 2080 video. The plugins I have installed are: HEX-Editor 0.9.5, JSON Viewer 1.34, Mime tools 2.5, Npp Converter 4.2.1, Npp Export 0.2.9, NppFavorites 1.0.0.1, Session Manager 1.4.3. At any given time I usually have about a dozen PHP files open.

Ekopalypse

@doubledeej

for example I created filters for process notepad++exe and file cydialog.pyx

and made sure the file activities are selected (red arrow).
You will get results like

The most interesting here are the write and close operations.

If you scroll more to the right you will see additional useful information

doubledeej

There isn’t much there. But the problem did occur in this scenario.

https://www.djprod.biz/NPPLogfile2.CSV

I created a new file, added some code, saved it as test.php, made some more changes, and the File / Save command was disabled.

Ekopalypse

@doubledeej

hmm, there are only 3 rows in your trace which do have test.php in it

"10:26:42.6211877 AM","notepad++.exe","34880","CreateFile","C:\redacted\test.php","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"10:26:42.6212222 AM","notepad++.exe","34880","QueryBasicInformationFile","C:\redacted\test.php","SUCCESS","CreationTime: 3/24/2020 10:26:42 AM, LastAccessTime: 3/24/2020 10:26:42 AM, LastWriteTime: 3/24/2020 10:26:42 AM, ChangeTime: 3/24/2020 10:26:42 AM, FileAttributes: A"
"10:26:42.6212463 AM","notepad++.exe","34880","CloseFile","C:\redacted\test.php","SUCCESS",""

Just a CreateFile with READ access a QueryBasicInformationFile and
a CloseFile. No WriteFile

Another strange thing, those APIs are normally not reported but
IRP_MJ_CREATE, IRP_MJ_QUERY_INFORMATION … are.

Can you post your debug-info from notepad++ ? menu?

How long is the path of "C:\redacted\test.php" in real?
Do you hit some ancient windows limits like 128 or 260 ?

doubledeej

I only uploaded the portions of the log that seemed relevant. I probably trimmed out too much. I’ve re-uploaded using the same URL as before without removing anything.

The real path of the files is 60 characters or fewer. All English alphanumeric characters, no spaces. The portion I removed was about 20 characters.

Notepad++ v7.8.5 (32-bit)
Build time : Mar 4 2020 - 11:04:20
Path : C:\Program Files (x86)\Notepad++\notepad++.exe
Admin mode : OFF
Local Conf mode : OFF
OS Name : Windows 10 Enterprise (64-bit)
OS Version : 1909
OS Build : 18363.720
Plugins : HexEditor.dll mimeTools.dll NppConverter.dll NppExport.dll NppFavorites.dll NPPJSONViewer.dll SessionMgr.dll

Ekopalypse

@doubledeej

first, I know why your report used createfile etc… while I’m used to see
IRP_MJ_CREATE - it is because I use enable advanced output from filter menu.

You said in an earlier post that this happened with a plain installed,
no plugins, npp as well, therefore I’m ignoring possible plugin issues.

The output doesn’t provide much new information about the problem,
except for one additional process.
It looks like you are using some kind of synchronization software named Resilio Sync.
I know it sounds weird but could you try to see if it happens as well while this software is temporarily disabled?
In addition, can you check
%APPDATA%\Resilio Sync\ShellExtIO.log
for reporting unusual behavior?

doubledeej

I shutdown Resilio Sync and the behavior of Notepad++ didn’t change.

doubledeej

I checked the Resilio log, and there doesn’t seem to be anything unusual in there.

Ekopalypse

@doubledeej - sorry, I’m running out of ideas.

doubledeej

I don’t know the code of Notepad++ (obviously), but it seems like whatever determines whether the file has been edited is what’s broken. When the problem happens, the File / Save command is grayed out, and the Ctrl-S keyboard shortcut doesn’t work. The tab’s icon also doesn’t change color to red when I make changes in the file, nor is the asterisk added to the window title bar. I can make all of the changes to the file I want, but N++ doesn’t seem to know that it has been changed. And it only affects new files – not ones that already existed.

My workaround has been to close the file after the initial save, then re-open it. Then everything works normally as it should. But if I forget, those changes are likely to be lost.

Terry R

@doubledeej said in File edits not changing file status:

(yes, I run AD at home)

As you are running AD, then I wonder if that environment is the cause of your issues. AD is useful if running multiple systems, so either you have multiple “real” PCs or possibly “virtual” PCs.

Reading through the posts on this and the fact that nothing thus far has worked, I can only suggest breaking it down into smaller portions. Granted you have already tried 32bit and 64bit installations. What about another PC within the AD environment (real or virtual), or take your system out of the AD environment (temporarily)? Only change 1 environment parameter at a time and through that you may be able to narrow down where the issue lies.

Are there any syncing apps involved such as One Drive that may be reverting the file to an earlier version?

Terry

Ekopalypse

@doubledeej said in File edits not changing file status:

I don’t know the code of Notepad++ (obviously), but it seems like whatever determines whether the file has been edited is what’s broken

But it doesn’t happen to most, I would argue 99.9% of the users and
therefore it is really hard to dig deeper if, for example, on my system everything works as expected.

doubledeej

@Terry-R My main PC is the only one experiencing the issue. Other computers on my network are working fine as of right now.

doubledeej

@Terry-R I don’t have any sync software configured on the directory in question. And the issue isn’t that the contents of the file are being overwritten, it’s that I don’t even have the option to save new files after the initial save. The Save command is disabled in the menu, the Control-S keyboard shortcut doesn’t work, and all visual indicators inside of Notepad++ that normally indicate that a file has been modified aren’t working. I can make changes in the file all day long and it refuses to let me save.

doubledeej

Still not working correctly in 7.8.6.