Reparse pdf files from Network volume

We are developing an encryption filter driver to protect pdf files. When a user wants to access a protected file, if he/she has permission to access, we create a plain file for encrypted file in a special local path and reparse to it. For this purpose in filecreate we do following steps:

  • Copy the new file name to FileObject->FileName
  • Irp->IoStatus.Status = STATUS_REPARSE;
  • Irp->IoStatus.Information = IO_REPARSE;
  • Return STATUS_REPARSE

And immediately receive a createfile for new (target) file.
The problem occurs when user open a protected file on network drive. After returning STATUS_REPARSE, we don?t receive any createfile for target file.
We have some questions:

  • Is it possible to reparse a remote file to a local one?
  • Or must be reparse to a file on same network drive? If we don?t have write access to network drive, how to create the target file?

Should work. What return value is the application seeing? Have you looked at
a ProcMon trace?

Also, have you tried this with something other than a PDF? For example, does
it work properly with a text file and Notepad?

-scott
OSR
@OSRDrivers

If Notepad opens the pdf file, It’s ok.
If extension of file(.pdf) removed from name, It’s open with Adobe Acrobat DC.

I know this problem exist for plain files on network, pdf and office files does not open.

In last row of procmon logs, I see a CreateFile with filename that contains “PIPE”. I filter this name(“PIPE”) in precreate and return PREOP_SUCCESS_NO_CALLBACK for it. The files will open!!!

  • What is effect of “PIPE” in filename?
  • How can detect operations with this specification?
  • How can manage these?

Are you setting FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS and filtering
FLT_FSTYPE_NPFS?

-scott
OSR
@OSRDrivers

No, There are not mentioned flags.

What’s the pipe name? There are several pipes that SMB uses to communicate
with the server (e.g. \pipe\srvsvc). You don’t really want to mess with
these in your filter.

-scott
OSR
@OSRDrivers