How deal with Fileoffset ?

NTFSD
1

Hello everybody

I am writing a file system filter driver on encryption / decryption. and I add some information in encrypted file header, When I read file, I want to skip

4096 bytes in IRP_MJ_READ, but I find some null characters be fill. It is why to this case.

my code as follow:

Tfsread()
{
if(!(Irp->Flag &(IRP_NOCACHE | IRP_PAGING_IO | IRP_SYSCHRONOUS_PAGING_IO)))
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver()
}
if(MyFile)
{
Offset.HighPart = 0;
Offset.LowPart = 4096;
IrpSp->Parameters.Read.ByteOffset = RtlLargeIntegerAdd(IrpSp->Parameters.Read.ByteOffset, Offset)
}
}

2

You are ignoring some I/O operations - notably paging I/O operations.
Since data is written via paging I/O operations this means that you will
not adjust the read and write size of such I/O, which would cause them
to overwrite your header.

Encryption filters that modify the data contents of the file are, in my
experience, extremely challenging.

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com