Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category, below.

Reparse pdf files from Network volume

m_sldm_sld Posts: 20
We are developing an encryption filter driver to protect pdf files. When a user wants to access a protected file, if he/she has permission to access, we create a plain file for encrypted file in a special local path and reparse to it. For this purpose in filecreate we do following steps:

- Copy the new file name to FileObject->FileName
- Irp->IoStatus.Status = STATUS_REPARSE;
- Irp->IoStatus.Information = IO_REPARSE;
- Return STATUS_REPARSE

And immediately receive a createfile for new (target) file.
The problem occurs when user open a protected file on network drive. After returning STATUS_REPARSE, we don?t receive any createfile for target file.
We have some questions:
- Is it possible to reparse a remote file to a local one?
- Or must be reparse to a file on same network drive? If we don?t have write access to network drive, how to create the target file?

Comments

  • Scott_NooneScott_Noone Posts: 2,989
    Should work. What return value is the application seeing? Have you looked at
    a ProcMon trace?

    Also, have you tried this with something other than a PDF? For example, does
    it work properly with a text file and Notepad?

    -scott
    OSR
    @OSRDrivers
  • m_sldm_sld Posts: 20
    If Notepad opens the pdf file, It's ok.
    If extension of file(.pdf) removed from name, It's open with Adobe Acrobat DC.

    I know this problem exist for plain files on network, pdf and office files does not open.

    In last row of procmon logs, I see a CreateFile with filename that contains "PIPE". I filter this name("PIPE") in precreate and return PREOP_SUCCESS_NO_CALLBACK for it. The files will open!!!

    - What is effect of "PIPE" in filename?
    - How can detect operations with this specification?
    - How can manage these?
  • Scott_NooneScott_Noone Posts: 2,989
    Are you setting FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS and filtering
    FLT_FSTYPE_NPFS?

    -scott
    OSR
    @OSRDrivers
  • m_sldm_sld Posts: 20
    No, There are not mentioned flags.
  • Scott_NooneScott_Noone Posts: 2,989
    What's the pipe name? There are several pipes that SMB uses to communicate
    with the server (e.g. \pipe\srvsvc). You don't really want to mess with
    these in your filter.

    -scott
    OSR
    @OSRDrivers
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!