I am writing a driver that would allow encryption/protection of specific files based on their name and/or content. I have already worked in anti-virus software development, so legacy-style attaching is not a problem to me, however I never needed to modify data stream to/from the lower driver. Two problems arose during my work.
- Modifying read data
I managed to allocate a new MDL, set UserBuffer and so on to cope with paging/non-cached IRP_MJ_WRITES. IRP_MJ_READ should be easier, because I can decrypt in-place, but some weird thing occurred.
I set a completion routine at IRP_MJ_READ and in the completion routine I have the following code:
void FsFilterDevice::ReadComplete(IN PIRP Irp, PVOID _context)
{
__try
{
void *Buffer=0;
if (Irp->MdlAddress)
{
DbgPrint(“%s getting address for MDL %p\n”, FUNCTION, Irp->MdlAddress);
Buffer=MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
}
else
{
Buffer=Irp->UserBuffer;
}
ULONG_PTR Length=Irp->IoStatus.Information;
DbgPrint(“%s probing for write %p %i\n”, FUNCTION, Buffer, Length);
ProbeForWrite(Buffer, Length, 1);
DbgPrint("%s modifying data\n, FUNCTION);
// decryption goes here
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
DbgPrint(“Exception: %08X\n”, GetExceptionCode());
}
And I never see the “modifying data” on the debugger. What I get is:
FsFilterDevice::ReadComplete getting address for MDL 82396C20
FsFilterDevice::ReadComplete probing for write F8C18000 13
Exception: C0000005
It is pretty strange, because MmGetSystemAddressForMdlSafe seems to return some non-zero address and does not raise any exception (as xxxSafe functions usually do on error). The buffer does not exceed one page, so it seems that the page address returned by MmGetSystemAddressForMdlSafe is invalid (probing for read fails as well, so it is not due to protection).
I am quite sure that some (most?) of you have a solution for this.
- The system file cache… Can I (and how) make some programs see encrypted and some see plain file? For example, when I decide to logoff a user, programs that have handle to an open file should see it decrypted and newly open files should be visible in an undecrypted form.
I know this questions are probably pretty lame (especially 1st one), but I am new to data modification and hope you will help me.
I was not asking