Hello all.
I saw this question was raised in various versions, but still haven’t found the correct path to follow.
I’m writing an encryption driver.
1.When my driver isn’t running and encrypted text files are read, by use of the notepad, they appear encrypted.
2.When I start my driver, I want them to display the proper data.
Since the notepad uses memory mapped files, I need to flush the data after it has been written and before it is read.
I tried using CcFlushCache() and CcPurgeCacheSection(…,…,…,TRUE) during post creation (to handle reading the fresh data) and during pre close (to flush written data).
I noticed that after I start my driver and open the file using notepad I get gibberish (that is, the file appears to be encrypted) . If I then close the notepad and reopen it a couple more times, the correct data is displayed.
This looked like a cache flushing synchronization issue to me.
I then tried adding CcUninitializeCacheMap() to the callbacks mentioned above and waited on an event indicating the flush was finished.
That changed nothing.
The data must be displayed correctly as soon as my driver is started.
I there some way to ensure the cache is cleared before reading the file?
Thanks,
Ariel.
xxxxx@hotmail.com wrote:
Hello all.
I saw this question was raised in various versions, but still haven’t found the correct path to follow.
I’m writing an encryption driver.
1.When my driver isn’t running and encrypted text files are read, by use of the notepad, they appear encrypted.
2.When I start my driver, I want them to display the proper data.
Since the notepad uses memory mapped files, I need to flush the data after it has been written and before it is read.
I tried using CcFlushCache() and CcPurgeCacheSection(…,…,…,TRUE) during post creation (to handle reading the fresh data) and during pre close (to flush written data).
I noticed that after I start my driver and open the file using notepad I get gibberish (that is, the file appears to be encrypted) . If I then close the notepad and reopen it a couple more times, the correct data is displayed.
This looked like a cache flushing synchronization issue to me.
I then tried adding CcUninitializeCacheMap() to the callbacks mentioned above and waited on an event indicating the flush was finished.
That changed nothing.
The data must be displayed correctly as soon as my driver is started.
I there some way to ensure the cache is cleared before reading the file?
There is no 100% method since the file could be actively mapped by a
user and hence any flushing of the data from cache will fail. Your best
option is to start your driver at boot time and ensure that none of your
encrypted files are read before you load.
Pete
Thanks,
Ariel.
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295