Encryption Driver

NTFSD
1

Hi all,

I’m developing a File System Filter Driver that encrypt files on a directory. It’s function OK on my test machine (K6-II 433)

I have filtered the read request and decript buffer in completion routine.

The buffer after MmGetSystemAddressForMdl() is different between Request and completion routines.

In my first test machine (K6 II - 433MHz - 128 MB) the buffer after MmGetSystemAddressForMdl in *completion routine* is filled and, in my second test machine (Pentium 100 - 80MB), the buffer after MmGetSystemAddressForMdl in *request routine* is filled.

Somebody know how can I identify it ?

Thanks in Advance,

Heldai Lemos Ferreira
Security Software Developer
S?o Paulo - Brazil

2

This can certainly happen. For example, an IRP_MJ_READ/IRP_MN_MDL can
easily cause this behavior, since the MDL is assigned by the file system,
not by the caller.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:

-----Original Message-----
From: Heldai [mailto:xxxxx@scuasecurity.com.br]
Sent: Monday, January 13, 2003 7:15 AM
To: File Systems Developers
Subject: [ntfsd] Encryption Driver

Hi all,

I’m developing a File System Filter Driver that encrypt files on a
directory. It’s function OK on my test machine (K6-II 433)

I have filtered the read request and decript buffer in completion routine.

The buffer after MmGetSystemAddressForMdl() is different between Request and
completion routines.

In my first test machine (K6 II - 433MHz - 128 MB) the buffer after
MmGetSystemAddressForMdl in completion routine is filled and, in my second
test machine (Pentium 100 - 80MB), the buffer after MmGetSystemAddressForMdl
in request routine is filled.

Somebody know how can I identify it ?

Thanks in Advance,

Heldai Lemos Ferreira

Security Software Developer

S?o Paulo - Brazil

—
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:>

3

Thanks Mason,

There is some way to identify it and assume the correct buffer pointer ?

Heldai

----- Original Message -----
From: “Tony Mason”
To: “File Systems Developers”
Sent: Monday, January 13, 2003 1:33 PM
Subject: [ntfsd] RE: Encryption Driver

> This can certainly happen. For example, an IRP_MJ_READ/IRP_MN_MDL can
> easily cause this behavior, since the MDL is assigned by the file system,
> not by the caller.
>
>
>
> Regards,
>
>
>
> Tony
>
>
>
> Tony Mason
>
> Consulting Partner
>
> OSR Open Systems Resources, Inc.
>
> http://www.osr.com http:
>
>
>
> -----Original Message-----
> From: Heldai [mailto:xxxxx@scuasecurity.com.br]
> Sent: Monday, January 13, 2003 7:15 AM
> To: File Systems Developers
> Subject: [ntfsd] Encryption Driver
>
>
>
> Hi all,
>
>
>
> I’m developing a File System Filter Driver that encrypt files on a
> directory. It’s function OK on my test machine (K6-II 433)
>
>
>
> I have filtered the read request and decript buffer in completion routine.
>
>
>
> The buffer after MmGetSystemAddressForMdl() is different between Request
and
> completion routines.
>
>
>
> In my first test machine (K6 II - 433MHz - 128 MB) the buffer after
> MmGetSystemAddressForMdl in completion routine is filled and, in my
second
> test machine (Pentium 100 - 80MB), the buffer after
MmGetSystemAddressForMdl
> in request routine is filled.
>
>
>
> Somebody know how can I identify it ?
>
>
>
> Thanks in Advance,
>
>
>
> Heldai Lemos Ferreira
>
> Security Software Developer
>
> S?o Paulo - Brazil
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
> To unsubscribe send a blank email to xxxxx@lists.osr.com</http:>

4

Sure - you just need to process the various I/O operations at the correct
time. In completion, the read has been satisfied and you can handle it
there.

What you should do is focus on non-cached I/O. That will eliminate these
issues anyway, since non-cached I/O means you won’t have to worry about this
case anyway.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Heldai [mailto:xxxxx@scuasecurity.com.br]
Sent: Monday, January 13, 2003 11:59 AM
To: File Systems Developers
Subject: [ntfsd] RE: Encryption Driver

Thanks Mason,

There is some way to identify it and assume the correct buffer pointer ?

Heldai

----- Original Message -----
From: “Tony Mason”
To: “File Systems Developers”
Sent: Monday, January 13, 2003 1:33 PM
Subject: [ntfsd] RE: Encryption Driver

> This can certainly happen. For example, an IRP_MJ_READ/IRP_MN_MDL can
> easily cause this behavior, since the MDL is assigned by the file system,
> not by the caller.
>
>
>
> Regards,
>
>
>
> Tony
>
>
>
> Tony Mason
>
> Consulting Partner
>
> OSR Open Systems Resources, Inc.
>
> http://www.osr.com http:
>
>
>
> -----Original Message-----
> From: Heldai [mailto:xxxxx@scuasecurity.com.br]
> Sent: Monday, January 13, 2003 7:15 AM
> To: File Systems Developers
> Subject: [ntfsd] Encryption Driver
>
>
>
> Hi all,
>
>
>
> I’m developing a File System Filter Driver that encrypt files on a
> directory. It’s function OK on my test machine (K6-II 433)
>
>
>
> I have filtered the read request and decript buffer in completion routine.
>
>
>
> The buffer after MmGetSystemAddressForMdl() is different between Request
and
> completion routines.
>
>
>
> In my first test machine (K6 II - 433MHz - 128 MB) the buffer after
> MmGetSystemAddressForMdl in completion routine is filled and, in my
second
> test machine (Pentium 100 - 80MB), the buffer after
MmGetSystemAddressForMdl
> in request routine is filled.
>
>
>
> Somebody know how can I identify it ?
>
>
>
> Thanks in Advance,
>
>
>
> Heldai Lemos Ferreira
>
> Security Software Developer
>
> S?o Paulo - Brazil
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
> To unsubscribe send a blank email to xxxxx@lists.osr.com

—
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:>

5

Thanks Mason,

I believe that it is the solution for me.

Heldai

----- Original Message -----
From: “Tony Mason”
To: “File Systems Developers”
Sent: Monday, January 13, 2003 8:55 PM
Subject: [ntfsd] RE: Encryption Driver

> Sure - you just need to process the various I/O operations at the correct
> time. In completion, the read has been satisfied and you can handle it
> there.
>
> What you should do is focus on non-cached I/O. That will eliminate these
> issues anyway, since non-cached I/O means you won’t have to worry about
this
> case anyway.
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: Heldai [mailto:xxxxx@scuasecurity.com.br]
> Sent: Monday, January 13, 2003 11:59 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Encryption Driver
>
> Thanks Mason,
>
> There is some way to identify it and assume the correct buffer pointer ?
>
> Heldai
>
> ----- Original Message -----
> From: “Tony Mason”
> To: “File Systems Developers”
> Sent: Monday, January 13, 2003 1:33 PM
> Subject: [ntfsd] RE: Encryption Driver
>
>
> > This can certainly happen. For example, an IRP_MJ_READ/IRP_MN_MDL can
> > easily cause this behavior, since the MDL is assigned by the file
system,
> > not by the caller.
> >
> >
> >
> > Regards,
> >
> >
> >
> > Tony
> >
> >
> >
> > Tony Mason
> >
> > Consulting Partner
> >
> > OSR Open Systems Resources, Inc.
> >
> > http://www.osr.com http:
> >
> >
> >
> > -----Original Message-----
> > From: Heldai [mailto:xxxxx@scuasecurity.com.br]
> > Sent: Monday, January 13, 2003 7:15 AM
> > To: File Systems Developers
> > Subject: [ntfsd] Encryption Driver
> >
> >
> >
> > Hi all,
> >
> >
> >
> > I’m developing a File System Filter Driver that encrypt files on a
> > directory. It’s function OK on my test machine (K6-II 433)
> >
> >
> >
> > I have filtered the read request and decript buffer in completion
routine.
> >
> >
> >
> > The buffer after MmGetSystemAddressForMdl() is different between Request
> and
> > completion routines.
> >
> >
> >
> > In my first test machine (K6 II - 433MHz - 128 MB) the buffer after
> > MmGetSystemAddressForMdl in completion routine is filled and, in my
> second
> > test machine (Pentium 100 - 80MB), the buffer after
> MmGetSystemAddressForMdl
> > in request routine is filled.
> >
> >
> >
> > Somebody know how can I identify it ?
> >
> >
> >
> > Thanks in Advance,
> >
> >
> >
> > Heldai Lemos Ferreira
> >
> > Security Software Developer
> >
> > S?o Paulo - Brazil
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@osr.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
> To unsubscribe send a blank email to xxxxx@lists.osr.com</http:>