A MiniFilter driver for encryption/decryption software With problem to autocad2004

NTFSD
1

I am developing a MiniFilter driver for encryption/decryption software. The MiniFilter driver catches I/O calls and encrypts or decrypts data on the fly. We are capturing IRP_MJ calls from FilterManager and then taking necessary actions on the IO.
I encrypt data in IRP_MJ_Write and decrypt data in IRP_MJ_READ.This minifilter work well in such software: notepad,word,powerpoint,excel.Now,I hava a problem when this minifilter to work with autocad2004.I use rc4 to encrypt data.
And the error message is :Only part of a ReadProcessMemory or WriteProcessMemory request was completed…I don’t know the reason,can you help me?

2

Hmm I am almost sure that you are making some sort of corruption with you encryption, and you screw up some binary files. From what you are telling me here this is what I can tell you.
When the loader will map the DLL’s in memory probably he is reading some encrypted stuff or something you are not coherent with.

3

Gabriel Bercea,thank you very much.
About your answer

  1. you screw up some binary files.
    I think I don’t.I have a switch in the minifilter driver. when I input ‘y’,the minifilter works and ‘n’ means the minifilter doesn’t work.In the test , I input ‘n’,autocad2004 works and no error.But input ‘y’,the error is out.So I think I don’t screw up binary files.
4

Do you process Set/Get Information requests in your driver?
Encryption operations asks alignment on encryption block size and you have
to save and process (decrypted) file size yourself.

Regards,
Michael.

5

thank you,Michael
I hava processed Set/Get Information requests in my driver.My driver works well in word,ppt,excel.I think it no problem,but don’t sure.Can you give some informathion about how to debug the driver with windbg?

6

Have you downloaded the current windbg, included with the latest WDK? Did you install it? Did you look for the tutorial in the program directory? Also look at the .doc/.docx files in all subdirectories, especially ‘themes’. Try it! There is a book that can help and any search should find it.

wrote in message news:xxxxx@ntfsd…

thank you,Michael
I have processed Set/Get Information requests in my driver.My driver works well in word,ppt,excel.I think it no problem,but don’t sure.Can you give some information about how to debug the driver with windbg?

7

yes , I have downloaded the currrent windbg,thank you,David!