The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm writing a basic kmdf-based upper disk filter that will encrypt vhds. (This is my first attempt at writing non-fs minifilter driver, so please bear with me).
I've reached to a point where I can attach to a test vhd and can see all the READs, WRITEs and IOCTLs happening on it. So far so good. Now I want to introduce encryption (during WRITE) and decryption piece (during POST READ) to this. For this I need to obviously first access data buffers for these IO requests which I do using WdfRequestRetrieveInputMemory / WdfRequestRetrieveOutputMemory functions. Couple of issues I've come across are:
Keeping the encryption part aside, I seem to be getting STATUS_ACCESS_VOILATION while copying data back from my local buffer to InputMemory. So in the write event callback,
Also, I understand that even for full-disk encryption, certain parts of the disk should not be subject to encryption/decryption process. E.g.
(https://community.osr.com/discussion/64507/problems-with-a-disk-encryption-filter-driver) IoReadPartitionTable is not subject to filtering. It ignores the disk upper filters.
So what are the sectors (I know about sector 0) I should watch out for and refrain from encrypting?
For testing, I create and attach a vhd manually using disk management. At this point my filter gets attached and receives all the READ, WRITE notifications.
The goal is to have encryption / decryption working transparently during vhd's lifetime and have operations such as creating and formatting volume with NTFS, and using it for fs operations succeed.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|