Hi,
As the title suggests, I’m writing a filter driver whose job is to be encrypt a volume entirely.
For this, I’ve written a kmdf-based volume filter driver that tracks all the READs, WRITEs and IOCLTs happening on the volume at the moment. I need to fit encryption/decryption part into this and for that need to understand what parts of a volume should be excluded from this process and be treated as clear text all the time?
I’ve read a related thread about this here https://community.osr.com/discussion/64507/problems-with-a-disk-encryption-filter-driver, and that sector 0 (boot sector) should be excluded but I guess it does not really apply in my case since I’m not really filtering a disk here.
I’m testing this with a vhd at the moment. So when I try to create a simple volume and format it with NTFS, I get below output. From the output I can see that reads are coming through long before first write on the volume is even issued. This suggests that one can not blindly just start doing encryption/decryption immediately after attaching to the volume stack.
Here’s the output from sample run (output has been truncated but removed stuff doesn’t contain write request):
KmdfHelloWorld: IOCTL Code → 5046280; OutputBufferLength → 0x102; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5046272; OutputBufferLength → 0x82; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5046296; OutputBufferLength → 0x10; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5636152; OutputBufferLength → 0x8; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 2953616; OutputBufferLength → 0x14; InputBufferLength → 0x8
KmdfHelloWorld: IOCTL Code → 5046284; OutputBufferLength → 0x20; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5636168; OutputBufferLength → 0x1; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5636096; OutputBufferLength → 0x20; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 458824; OutputBufferLength → 0x90; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 458832; OutputBufferLength → 0x1000; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5095440; OutputBufferLength → 0x0; InputBufferLength → 0x62
KmdfHelloWorld: IOCTL Code → 5046288; OutputBufferLength → 0x0; InputBufferLength → 0x62
KmdfHelloWorld: IOCTL Code → 5095440; OutputBufferLength → 0x0; InputBufferLength → 0x1e
KmdfHelloWorld: IOCTL Code → 5046288; OutputBufferLength → 0x0; InputBufferLength → 0x1e
KmdfHelloWorld: IOCTL Code → 5685256; OutputBufferLength → 0x0; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5046280; OutputBufferLength → 0x102; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5046280; OutputBufferLength → 0x102; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 5685348; OutputBufferLength → 0x0; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 2953612; OutputBufferLength → 0x48; InputBufferLength → 0x4
KmdfHelloWorld: IOCTL Code → 458752; OutputBufferLength → 0x18; InputBufferLength → 0x0
KmdfHelloWorld: IO → READ; DeviceOffset → 32768; Length → 2048;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFAC819AA4F000; Length → 0x800; Status → 0x0; Information → 2048
…
…
KmdfHelloWorld: IOCTL Code → 2952212; OutputBufferLength → 0x8; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 2953344; OutputBufferLength → 0xc; InputBufferLength → 0x0
KmdfHelloWorld: IO → READ; DeviceOffset → 0; Length → 4096;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFAC819AA50000; Length → 0x1000; Status → 0x0; Information → 4096
…
…
KmdfHelloWorld: IOCTL Code → 2954240; OutputBufferLength → 0x400; InputBufferLength → 0xc
KmdfHelloWorld: IOCTL Code → 2953616; OutputBufferLength → 0x14; InputBufferLength → 0x8
KmdfHelloWorld: IO → READ; DeviceOffset → 0; Length → 512;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFCF86AFC619A0; Length → 0x200; Status → 0x0; Information → 512
…
…
KmdfHelloWorld: IOCTL Code → 475228; OutputBufferLength → 0x8; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 458752; OutputBufferLength → 0x18; InputBufferLength → 0x0
KmdfHelloWorld: IO → READ; DeviceOffset → 0; Length → 512;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFAC819AA5B000; Length → 0x200; Status → 0x0; Information → 512
KmdfHelloWorld: IOCTL Code → 475228; OutputBufferLength → 0x8; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 458752; OutputBufferLength → 0x18; InputBufferLength → 0x0
KmdfHelloWorld: IO → READ; DeviceOffset → 0; Length → 512;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFAC819AA5C000; Length → 0x200; Status → 0x0; Information → 512
KmdfHelloWorld: IOCTL Code → 475228; OutputBufferLength → 0x8; InputBufferLength → 0x0
KmdfHelloWorld: IOCTL Code → 458752; OutputBufferLength → 0x18; InputBufferLength → 0x0
KmdfHelloWorld: IO → READ; DeviceOffset → 0; Length → 512;
KmdfHelloWorld: IO → POST READ; Buffer → 0xFFFFAC819AA5D000; Length → 0x200; Status → 0x0; Information → 512
Also, I found that there’s scarcity of information when it comes to writing volume filter drivers (on the contrary to say fs minifilters etc).
So if you happen to have links, documentation that talk about care to be taken while writing such filter drivers and share those that will be great.
Thanks