Encryption and decryption of cd/dvd burn events

NTFSD
1

Hi Folks,

I wrote a simple lower filter driver for CDROM class (4D36E965-E325-11CE-BFC1-08002BE10318) that would implement the the encryption and decryption of cd/dvd burn events coming from nero software.

Let me explain what I have done so far and then I’ll post the question.

  1. I took simple XPR operation when I saw SCSIOP_WRITE( come from IOCTL_SCSI_PASS_THROUGH_DIRECT through IRP_MJ_DEVICE_CONTROL)
  2. I set a completion routine when I saw SCSIOP_READ( come from SRB_FUNCTION_EXECUTE_SCSI through
    IRP_MJ_INTERNAL_DEVICE_CONTROL), in which I took the same XPR operation to decrypt the data.

3.IRP_MJ_DEVICE_CONTROL - IOCTL_SCSI_PASS_THROUGH_DIRECT£¨encryption part£©

ULONG ContrlCode=irpStack->Parameters.DeviceIoControl.IoControlCode;unsigned short DeviceType=(unsigned short)(ContrlCode/0x100); if(ContrlCode==IOCTL_SCSI_PASS_THROUGH_DIRECT){ ULONG transType=ContrlCode&0x3; UCHAR* inBuf=NULL;
if (transType == METHOD_BUFFERED) inBuf=(UCHAR*)Irp->AssociatedIrp.SystemBuffer ; if(inBuf) { PSCSI_PASS_THROUGH_DIRECT cmd=(PSCSI_PASS_THROUGH_DIRECT)inBuf; if(cmd->Cdb[0]==SCSIOP_WRITE) { UCHAR* cacheBuf=NULL; UCHAR Buf1=‘2’;//XOR ‘2’ ULONG i,buflen; cacheBuf=(UCHAR*)cmd->DataBuffer; buflen=cmd->DataTransferLength; if(cacheBuf) { for(i=0;i
4¡¢IRP_MJ_INTERNAL_DEVICE_CONTROL£¨decryption part£©

PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);PSCSI_REQUEST_BLOCK CurSrb=irpSp->Parameters.Scsi.Srb;
if(SRB_FUNCTION_EXECUTE_SCSI==CurSrb->Function){ PCDB cdb = (PCDB)CurSrb->Cdb; UCHAR opCode=cdb->CDB10.OperationCode; switch(opCode) { case SCSIOP_READ: { IoCopyCurrentIrpStackLocationToNext(Irp); IoSetCompletionRoutine(Irp,FilterSCSIReadCompletion,NULL,TRUE,TRUE,TRUE); status = IoCallDriver(deviceExtension->NextLowerDriver,Irp); return status; break; }… }}

5. completion routine

NTSTATUS FilterSCSIReadCompletion( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context ){ ULONG i,buflen; UCHAR Buf1=‘2’; UCHAR* cacheBuf=NULL;
PDEVICE_EXTENSION deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp); PSCSI_REQUEST_BLOCK CurSrb=irpSp->Parameters.Scsi.Srb; buflen=CurSrb->DataTransferLength; cacheBuf=(UCHAR*)CurSrb->DataBuffer;
if (Irp->PendingReturned) IoMarkIrpPending( Irp ); if(cacheBuf) { for(i=0;iRemoveLock, Irp); return(STATUS_SUCCESS);}

Qusetions:When I try to read a cd encrypted, there is nothing visible. but I can see something using the WinHex
software that confirmed the cd have been encrypted indeedly.

Any help is much appreciated.
Thanks.
_________________________________________________________________
Windows Live Custom Domain£¬ÄúµÄÃâ·Ñµç×ÓÓʾ֡£
https://domains.live.com/default.aspx