file header and save in office

NTFSD
1

Hi,
I developed a minifilter driver that add header to office files.
I add the header in the pre-cleanup operation.
I have a problem with the way office applications do the save.
I understand (from other posts and procmon) that what happen is:

  1. orig file rename to xxx.tmp
  2. file is written in another tmp file (in some office its .tmp in other its without extension)
  3. the secondary file is being rename into the orig file name (.doc, .docx …)

My problem is that the secondary tmp file is without my header (I guess because the office application doesn’t see my header) and when the (3) rename happen my header is lost.
I tried to put it back in two different places but both are causing weird problems with the office.

  1. first place I tried in the SET_INFORMATION when the tmp file is renamed to the orig file name I added it to the tmp file. This way the orig file will get the header. This method work in most cases but cause weird timing/sharing violations in office.
  2. Second place I tried to add it to the tmp file when it is closed. This also failed with same weird errors (some times)

What is the best place to re-add the header?
Is there a method to make it stay?
The rename operation is the first place that I actually know that this tmp file is my original doc file and is going to be renamed to it.

Thanks,
Sagi

2

> I add the header in the pre-cleanup operation.
Do you really shift all the data in the file in pre-cleanup?
Do you know that there can be paging writes after cleanup?
Are you aware of cached vs. non-cached IOs at all? I.e. Do you use non-cached operations in pre-cleanup? It doesn’t seem to me.

Adding header/footer into the file is really difficult task. You should ensure that the file cache is consistent and coherent between processes. The application version of the cached file must be isolated from your version with header. It implies that you either must use and intercept just non-cached IOs or use different cached file for file with header. I believe you need layered File System to achieve it. If I were you I would consider storing headers into different store e.g. if you limit your solution to the NTFS you can use special file stream for header. With that solution you can avoid implementation of layered FS.

Good luck
Bronislav Gabrhelik