encryption filter driver

NTFSD
1

I’m trying to do online encrypt/decrypt via filter driver. The problem I
have is, that when I want to read a file (for example with notepad), there
is no read request IRP_MJ_READ or FastIoRead. So I’m not able to decrypt
the data.

Please help me.

xxxxx@taureus.sk

2

hello friend,

I think Filemonitor or DiskMonitor filter driver samples can help you a lot.

regards
Ashish

-----Original Message-----
From: xxxxx@taureus.sk [SMTP:xxxxx@taureus.sk]
Sent: Friday, October 13, 2000 11:38 AM
To: File Systems Developers
Subject: [ntfsd] encryption filter driver

I’m trying to do online encrypt/decrypt via filter driver. The problem I
have is, that when I want to read a file (for example with notepad), there
is no read request IRP_MJ_READ or FastIoRead. So I’m not able to decrypt
the data.

Please help me.

xxxxx@taureus.sk

You are currently subscribed to ntfsd as: ashishm@i3-micro.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

> I’m trying to do online encrypt/decrypt via filter driver. The problem I

have is, that when I want to read a file (for example with notepad), there
is no read request IRP_MJ_READ or FastIoRead. So I’m not able to decrypt
the data.

There must be IRP_MJ_READ for IRP_PAGING_IO.

Max

4

This question was discussed twice or three times in this mail list. You can
find majority of things you need in this moment in mail list archive.

Best regards
mari

-----Original Message-----
From: xxxxx@taureus.sk [mailto:xxxxx@taureus.sk]
Sent: Friday, October 13, 2000 11:38 AM
To: File Systems Developers
Subject: [ntfsd] encryption filter driver

I’m trying to do online encrypt/decrypt via filter driver. The problem I
have is, that when I want to read a file (for example with notepad), there
is no read request IRP_MJ_READ or FastIoRead. So I’m not able to decrypt
the data.

Please help me.

xxxxx@taureus.sk

You are currently subscribed to ntfsd as: xxxxx@decros.cz
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

5

Please, help me with this problem:

I developed filter driver based on Sfilter example of IFS kit (for Windows
2000). It’s attached on \Device\RawDisk and, as it was told me, it’s abowe
file system. I have the following problem:

1)when I pressed F3 in notepad.exe, I received IRP_MJ_READ with MDL buffer.
After that, I received IRP_MJ_READ with UserBuffer.

  1. On the next F4 press, I don’t get any IRP_MJ_READ request.

On FastIoRead|Write I return FALSE.

Please help me.

6

Why would you expect to receive another IRP_MJ_READ?

Notepad (in Windows 2000) uses memory mapped files. Thus, the first time
you see an IRP_MJ_READ, it is the VM system page faulting the file into the
VM cache. The second time you access the file, the data is already IN the
VM cache, so there’s no reason to re-read it again.

As for FastIoRead/Write, they are only used for user-mode read/write
operations. Since Notepad is using mapped file access, there are no
corresponding read/write calls.

Regards,

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@taureus.sk [mailto:xxxxx@taureus.sk]
Sent: Thursday, October 19, 2000 8:00 PM
To: File Systems Developers
Subject: [ntfsd] filter driver

Please, help me with this problem:

I developed filter driver based on Sfilter example of IFS kit (for Windows
2000). It’s attached on \Device\RawDisk and, as it was told me, it’s abowe
file system. I have the following problem:

1)when I pressed F3 in notepad.exe, I received IRP_MJ_READ with MDL buffer.
After that, I received IRP_MJ_READ with UserBuffer.

  1. On the next F4 press, I don’t get any IRP_MJ_READ request.

On FastIoRead|Write I return FALSE.

Please help me.

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

7

Is the F4 like F3 to find next or do some read stuff?

jianjing qin

8

For Windows Commander:

F4 - edit (runs notepad.exe)
F3 - view

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of xxxxx@tivoli.com
Sent: 20. oktobra 2000 20:09
To: File Systems Developers
Subject: [ntfsd] Re: filter driver

Is the F4 like F3 to find next or do some read stuff?

jianjing qin

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

9

Thank you for explanation.
Is there any way how to overcome it (I want to en/decrypt the file)?

best regards

Igor Rosenberg
xxxxx@taureus.sk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tony Mason
Sent: 20. októbra 2000 16:57
To: File Systems Developers
Subject: [ntfsd] RE: filter driver

Why would you expect to receive another IRP_MJ_READ?

Notepad (in Windows 2000) uses memory mapped files. Thus, the first time
you see an IRP_MJ_READ, it is the VM system page faulting the file into the
VM cache. The second time you access the file, the data is already IN the
VM cache, so there’s no reason to re-read it again.

As for FastIoRead/Write, they are only used for user-mode read/write
operations. Since Notepad is using mapped file access, there are no
corresponding read/write calls.

Regards,

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@taureus.sk [mailto:xxxxx@taureus.sk]
Sent: Thursday, October 19, 2000 8:00 PM
To: File Systems Developers
Subject: [ntfsd] filter driver

Please, help me with this problem:

I developed filter driver based on Sfilter example of IFS kit (for Windows
2000). It’s attached on \Device\RawDisk and, as it was told me, it’s abowe
file system. I have the following problem:

1)when I pressed F3 in notepad.exe, I received IRP_MJ_READ with MDL buffer.
After that, I received IRP_MJ_READ with UserBuffer.

  1. On the next F4 press, I don’t get any IRP_MJ_READ request.

On FastIoRead|Write I return FALSE.

Please help me.

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

10

In general, I suggest that anyone doing data transformations focus on doing
them for the IRP_MJ_READ and IRP_MJ_WRITE case where the IRP_NOCACHE bit is
set. This picks up both user non-cached I/O and paging I/O.

Regards,

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Igor Rosenberg [mailto:xxxxx@taureus.sk]
Sent: Monday, October 23, 2000 3:40 AM
To: File Systems Developers
Subject: [ntfsd] RE: filter driver

Thank you for explanation.
Is there any way how to overcome it (I want to en/decrypt the file)?

best regards

Igor Rosenberg
xxxxx@taureus.sk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tony Mason
Sent: 20. okt?bra 2000 16:57
To: File Systems Developers
Subject: [ntfsd] RE: filter driver

Why would you expect to receive another IRP_MJ_READ?

Notepad (in Windows 2000) uses memory mapped files. Thus, the first time
you see an IRP_MJ_READ, it is the VM system page faulting the file into the
VM cache. The second time you access the file, the data is already IN the
VM cache, so there’s no reason to re-read it again.

As for FastIoRead/Write, they are only used for user-mode read/write
operations. Since Notepad is using mapped file access, there are no
corresponding read/write calls.

Regards,

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@taureus.sk [mailto:xxxxx@taureus.sk]
Sent: Thursday, October 19, 2000 8:00 PM
To: File Systems Developers
Subject: [ntfsd] filter driver

Please, help me with this problem:

I developed filter driver based on Sfilter example of IFS kit (for Windows
2000). It’s attached on \Device\RawDisk and, as it was told me, it’s abowe
file system. I have the following problem:

1)when I pressed F3 in notepad.exe, I received IRP_MJ_READ with MDL buffer.
After that, I received IRP_MJ_READ with UserBuffer.

  1. On the next F4 press, I don’t get any IRP_MJ_READ request.

On FastIoRead|Write I return FALSE.

Please help me.

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@taureus.sk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)