Hi all,
I have a filter driver. It will do on the fly encrypt/decrypt.
Currently, I’m seeing a very strange problem:
After opening an encrypted xls file via Microsoft Excel, if user kill
Excel(select end Excel process in Windows Task Manager->Process Tab,
or write a small test program that call TerminateProcess() to kill
Excel), the encrypted xls file become completely clear context. In
here, kill Excel process is required(close Excel application, the
problem won’t happen).
It is hard to image that I miss some IRP_NOCACHE IRP or paging
I/O. I tried many other applications. None of them has this problem.
Even for Excel, as long as not killing Excel, it will work fine(opening,
editing, saving, closing…). It seems if I miss some IRP_NOCACHE IRP
or paging I/O, it will be very easy to fail on something like file saving.
From Excel itself, I can see when opening xls file, xls file time stamp
is changed to current time. When close Excel(no editing, no file saving),
the xls file time stamp is restored to original. But in FileSpy, I can
not see this same name new xls file is created.
I know many of you work on encrypt/decrypt filter driver. Did you have this
experience before? Or if you have some deep understanding about how Excel
manipulate xls file, please give me some suggestion. I just can not image
what kind of special way that Excel use to control a file.
Any suggestion is welcome.
Thanks