filter driver question

NTFSD
1

Hi all,

I have a problem with my encryption filter driver. When I use notepad for
W2000 to read a file, I get IRP_MJ_READ with paging IO (IRP_NOCACHE |
IRP_PAGING_IO). At this point, I will decrypt it. When I reopen the file
next time, I don’t get paging IO, so I will not decrypt it. This works
fine, so far. But, when I use notepad for W98, I don’t get paging IO, just
regular read. My question is, how can I tell when to decrypt? If I do
decryption only on paging IO, it will not work with regular read (notepad
for W98).

Thanks
Igor.

2

Ahh, the beauty of 'cross platform" development:-)
There are no IRPs in 9x/Me, and no paging or non paging…
You just have to encrypt or decrypt on ALL writes or reads, respectively.

Regards, Dejan.

Igor Rosenberg wrote:

Hi all,

I have a problem with my encryption filter driver. When I use notepad for
W2000 to read a file, I get IRP_MJ_READ with paging IO (IRP_NOCACHE |
IRP_PAGING_IO). At this point, I will decrypt it. When I reopen the file
next time, I don’t get paging IO, so I will not decrypt it. This works
fine, so far. But, when I use notepad for W98, I don’t get paging IO, just
regular read. My question is, how can I tell when to decrypt? If I do
decryption only on paging IO, it will not work with regular read (notepad
for W98).

Thanks
Igor.

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.

3

Ok, but I’m developing the driver under W2000. I just used notepad for
W98 under W2000 to test it. The situation is as follow: When I use
notepad W2000, I get paging IO. Here I do the decryption. Next I get
neither IO, so I do nothing. Next, I run notepad W98, I get neither IO,
and I do not decrypt. This situation is ok.

But, when I first run notepad W98, I receive neither IO. How should I
know, that there was no paging IO before, so I can decrypt?

I was looking for flags like DO_DIRECT_IO, DO_BUFFERED_IO, but I have
not found them in the IRP_MJ_READ.

Regards
Igor.

Ahh, the beauty of 'cross platform" development:-)
There are no IRPs in 9x/Me, and no paging or non paging…
You just have to encrypt or decrypt on ALL writes or
reads, respectively.

Regards, Dejan.

Igor Rosenberg wrote:

> Hi all,
>
> I have a problem with my encryption filter driver. When I
use notepad
> for W2000 to read a file, I get IRP_MJ_READ with paging IO
> (IRP_NOCACHE | IRP_PAGING_IO). At this point, I will
decrypt it. When
> I reopen the file next time, I don’t get paging IO, so I will not
> decrypt it. This works fine, so far. But, when I use
notepad for W98,
> I don’t get paging IO, just regular read. My question is, how can I
> tell when to decrypt? If I do decryption only on paging IO, it will
> not work with regular read (notepad for W98).
>
> Thanks
> Igor.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com To
> unsubscribe send a blank email to %%email.unsub%%

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32
developers. Alfa File Protector - File protection and hiding
library for Win32 developers.

You are currently subscribed to ntfsd as:
xxxxx@taureus.sk To unsubscribe send a blank email to
%%email.unsub%%

4

When you run Notepad98 in FIRST place, do you see file contents decrypted or
bogus?

-htfv

----- Original Message -----
From: “Igor Rosenberg”
To: “File Systems Developers”
Sent: Tuesday, September 24, 2002 8:55 AM
Subject: [ntfsd] Re: filter driver question

> Ok, but I’m developing the driver under W2000. I just used notepad for
> W98 under W2000 to test it. The situation is as follow: When I use
> notepad W2000, I get paging IO. Here I do the decryption. Next I get
> neither IO, so I do nothing. Next, I run notepad W98, I get neither IO,
> and I do not decrypt. This situation is ok.
>
> But, when I first run notepad W98, I receive neither IO. How should I
> know, that there was no paging IO before, so I can decrypt?
>
> I was looking for flags like DO_DIRECT_IO, DO_BUFFERED_IO, but I have
> not found them in the IRP_MJ_READ.
>
> Regards
> Igor.
>
> > Ahh, the beauty of 'cross platform" development:-)
> > There are no IRPs in 9x/Me, and no paging or non paging…
> > You just have to encrypt or decrypt on ALL writes or
> > reads, respectively.
> >
> > Regards, Dejan.
> >
> > Igor Rosenberg wrote:
> >
> > > Hi all,
> > >
> > > I have a problem with my encryption filter driver. When I
> > use notepad
> > > for W2000 to read a file, I get IRP_MJ_READ with paging IO
> > > (IRP_NOCACHE | IRP_PAGING_IO). At this point, I will
> > decrypt it. When
> > > I reopen the file next time, I don’t get paging IO, so I will not
> > > decrypt it. This works fine, so far. But, when I use
> > notepad for W98,
> > > I don’t get paging IO, just regular read. My question is, how can I
> > > tell when to decrypt? If I do decryption only on paging IO, it will
> > > not work with regular read (notepad for W98).
> > >
> > > Thanks
> > > Igor.
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@alfasp.com To
> > > unsubscribe send a blank email to %%email.unsub%%
> >
> > –
> > Kind regards, Dejan M. www.alfasp.com
> > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > Alfa File Monitor - File monitoring library for Win32
> > developers. Alfa File Protector - File protection and hiding
> > library for Win32 developers.
> >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@taureus.sk To unsubscribe send a blank email to
> > %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

5

You are looking at the wrong flags then. Look for IRP_PAGING_IO in
Irp->Flags during Read/Write, to see if the I/O is paging IO - look for
IRP_NOCACHE to see when you need to decrypt.
One more thing - if you are opening the same file with Notepad 98, then
you won’t see any paging IO since the data is already in the cache.

Regards, Dejan.

Igor Rosenberg wrote:

Ok, but I’m developing the driver under W2000. I just used notepad for
W98 under W2000 to test it. The situation is as follow: When I use
notepad W2000, I get paging IO. Here I do the decryption. Next I get
neither IO, so I do nothing. Next, I run notepad W98, I get neither IO,
and I do not decrypt. This situation is ok.

But, when I first run notepad W98, I receive neither IO. How should I
know, that there was no paging IO before, so I can decrypt?

I was looking for flags like DO_DIRECT_IO, DO_BUFFERED_IO, but I have not
found them in the IRP_MJ_READ.

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.

6

At this situation, the file contents is encrypted.

Igor.

When you run Notepad98 in FIRST place, do you see file
contents decrypted or bogus?

-htfv

----- Original Message -----
From: “Igor Rosenberg”
> To: “File Systems Developers”
> Sent: Tuesday, September 24, 2002 8:55 AM
> Subject: [ntfsd] Re: filter driver question
>
>
> > Ok, but I’m developing the driver under W2000. I just used
> notepad for
> > W98 under W2000 to test it. The situation is as follow: When I use
> > notepad W2000, I get paging IO. Here I do the decryption.
> Next I get
> > neither IO, so I do nothing. Next, I run notepad W98, I get neither
> > IO, and I do not decrypt. This situation is ok.
> >
> > But, when I first run notepad W98, I receive neither IO.
> How should I
> > know, that there was no paging IO before, so I can decrypt?
> >
> > I was looking for flags like DO_DIRECT_IO, DO_BUFFERED_IO,
> but I have
> > not found them in the IRP_MJ_READ.
> >
> > Regards
> > Igor.
> >
> > > Ahh, the beauty of 'cross platform" development:-)
> > > There are no IRPs in 9x/Me, and no paging or non paging…
> > > You just have to encrypt or decrypt on ALL writes or reads,
> > > respectively.
> > >
> > > Regards, Dejan.
> > >
> > > Igor Rosenberg wrote:
> > >
> > > > Hi all,
> > > >
> > > > I have a problem with my encryption filter driver. When I
> > > use notepad
> > > > for W2000 to read a file, I get IRP_MJ_READ with paging IO
> > > > (IRP_NOCACHE | IRP_PAGING_IO). At this point, I will
> > > decrypt it. When
> > > > I reopen the file next time, I don’t get paging IO, so
> I will not
> > > > decrypt it. This works fine, so far. But, when I use
> > > notepad for W98,
> > > > I don’t get paging IO, just regular read. My question
> is, how can
> > > > I tell when to decrypt? If I do decryption only on
> paging IO, it
> > > > will not work with regular read (notepad for W98).
> > > >
> > > > Thanks
> > > > Igor.
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@alfasp.com To
> > > > unsubscribe send a blank email to %%email.unsub%%
> > >
> > > –
> > > Kind regards, Dejan M. www.alfasp.com
> > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > Alfa File Monitor - File monitoring library for Win32 developers.
> > > Alfa File Protector - File protection and hiding library
> for Win32
> > > developers.
> > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@taureus.sk To
> > > unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@taureus.sk To unsubscribe send a blank email to
> %%email.unsub%%
>