Encryption Minifilter Question

NTFSD
1

Hi,

I’m in the process of writing an Encryption / Decryption minifilter driver
which will only encrypt / decrypt files with certain file extensions. I’m
using the swapBuffers & scanner samples to get me started, and I’m able to
manipulate the buffers before they are written to disk.

Although I’m very new to mini filter development, and have a very basic
design question. When I intercept the IRP_MJ_WRITE, in the SwapPreWrite
function, is it possible to expand the size of the buffer to allow for
encryption header information? Also, when is the best time to write
encryption header information, perhaps in IRP_MJ_CREATE?

I’ve tried basic things like setting the Length parameter to be slightly
larger than what is specified originally, but unfortunately this causes a
BSOD. My driver needs to be able to determine if data being read is
encrypted before performing decryption.

Any help / books titles / links / anything would be appreciated.

Many thanks,

Danny.

2

Let me be the first to say: Use search. That’s what others will tell
you no doubt :wink:

Danny Draper wrote:

Hi,

I’m in the process of writing an Encryption / Decryption minifilter
driver
which will only encrypt / decrypt files with certain file extensions.
I’m
using the swapBuffers & scanner samples to get me started, and I’m
able to
manipulate the buffers before they are written to disk.

Although I’m very new to mini filter development, and have a very
basic
design question. When I intercept the IRP_MJ_WRITE, in the
SwapPreWrite
function, is it possible to expand the size of the buffer to allow for

encryption header information? Also, when is the best time to write
encryption header information, perhaps in IRP_MJ_CREATE?

I’ve tried basic things like setting the Length parameter to be
slightly
larger than what is specified originally, but unfortunately this
causes a
BSOD. My driver needs to be able to determine if data being read is
encrypted before performing decryption.

Any help / books titles / links / anything would be appreciated.

Many thanks,

Danny.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.