Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category, below.

Reparse pdf files from Network volume

m_sldm_sld Posts: 20
We are developing an encryption filter driver to protect pdf files. When a user wants to access a protected file, if he/she has permission to access, we create a plain file for encrypted file in a special local path and reparse to it. For this purpose in filecreate we do following steps:

- Copy the new file name to FileObject->FileName
- Irp->IoStatus.Status = STATUS_REPARSE;
- Irp->IoStatus.Information = IO_REPARSE;

And immediately receive a createfile for new (target) file.
The problem occurs when user open a protected file on network drive. After returning STATUS_REPARSE, we don?t receive any createfile for target file.
We have some questions:
- Is it possible to reparse a remote file to a local one?
- Or must be reparse to a file on same network drive? If we don?t have write access to network drive, how to create the target file?


  • Scott_NooneScott_Noone Posts: 2,989
    Should work. What return value is the application seeing? Have you looked at
    a ProcMon trace?

    Also, have you tried this with something other than a PDF? For example, does
    it work properly with a text file and Notepad?

  • m_sldm_sld Posts: 20
    If Notepad opens the pdf file, It's ok.
    If extension of file(.pdf) removed from name, It's open with Adobe Acrobat DC.

    I know this problem exist for plain files on network, pdf and office files does not open.

    In last row of procmon logs, I see a CreateFile with filename that contains "PIPE". I filter this name("PIPE") in precreate and return PREOP_SUCCESS_NO_CALLBACK for it. The files will open!!!

    - What is effect of "PIPE" in filename?
    - How can detect operations with this specification?
    - How can manage these?
  • Scott_NooneScott_Noone Posts: 2,989
    Are you setting FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS and filtering

  • m_sldm_sld Posts: 20
    No, There are not mentioned flags.
  • Scott_NooneScott_Noone Posts: 2,989
    What's the pipe name? There are several pipes that SMB uses to communicate
    with the server (e.g. \pipe\srvsvc). You don't really want to mess with
    these in your filter.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!