Hello Gurus,
We wrote a basic File System Filter Driver doing On the Fly encryption and
Decryption some 6 months back.
We had made it pretty simple without worrying about Headers/trailers.
We had tested it thoroughly in all cases with all files.
I have found that it works good for all the files except some Exe Files.
When i double click the Exe file(for example winhelp.exe) i find that the
exe file just brings up a command window.
But i used a Hex editor to look at the Exe file and found it exactly the
same when compared to the original unencrypted file.
Has anyone encountered any problems like this?
I have found this happening only in certain “Exe” files. As such i have not
seen this happening in any other extension file.
I would appreciate some input from you guys…
Regards
Shal.
You have to map all requests going to your filter in that
“corruption” case and thoroughly check if all of them are
handled correctly by your driver. This is including the
returned values and data. Compare them with the actions
on the clean system.
Try to find the as small executable as possible, it will ease
comparing of data loaded into memory.
L.