none
File filter driver to transparent encrypt some folder RRS feed

  • Question

  • Hi all,

    I'm writing a file filter driver to transparent encrypt some folder. I intercept IRP_MJ_READ, IRP_MJ_WRITE to encrypt/decypt on data buffer. However, i got a problem : when open a file by notepad driver doesn't receive IRP_MJ_READ, but open a file by notepad++, wordpad driver can receive IRP_MJ_READ.

    Please help me to find out what is problem.

    Thanks in advance.

    Tuesday, August 5, 2014 1:15 PM

Answers

  • Notepad is using memory mapped I/O, so you will be seeing paging requests for the information.  You will need to handle more than just read and write, there are a number of paging and cache operations that need to be addressed.  Encryption filters are one of the hardest drivers to write in Windows.   I recommend you go the http://www.osronline.com and ask the questions on the NTFSD list, that is where the file system driver types hang out.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by The Si Tuesday, August 5, 2014 2:33 PM
    Tuesday, August 5, 2014 1:28 PM

All replies

  • Notepad is using memory mapped I/O, so you will be seeing paging requests for the information.  You will need to handle more than just read and write, there are a number of paging and cache operations that need to be addressed.  Encryption filters are one of the hardest drivers to write in Windows.   I recommend you go the http://www.osronline.com and ask the questions on the NTFSD list, that is where the file system driver types hang out.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by The Si Tuesday, August 5, 2014 2:33 PM
    Tuesday, August 5, 2014 1:28 PM
  • Thanks for your help.
    Tuesday, August 5, 2014 2:34 PM