How to detect file SEEK operations on NT filter FSD

NTFSD
1

I’m writing a filter FSD.
Each file that is supposed to get processed has additional data (metadata)
at the end of the file stream which I add. The metadata isn’t supposed to
be ‘seen’ by the user/application.
The metadata structure can’t be part of the extended attributes because of
windows 95/98 compatibility.

I need to hide the existance of the metadata from the application which is
using the file so that when it accesses the file data,
it treats it like a regular file.
The problem is that when the application does a file seek operation
relative to the end of the file,
the NT calculates the file position without notifying my driver so I can’t
‘fix’ the position to ignore the metadata existance.

thanks for your help,
A.K.

2

You need to just the file size so that applications see the file size
without your footer.

You need to adjust the file size for IRP_MJ_DIRECTORY_CONTROL for the
FileDirectoryInformation, FileFullDirectoryInformation, and
FileBothDirectoryInformation _FILE_INFORMATION_CLASS requests.

And for IRP_MJ_QUERY_INFORMATION for the FileStandardInformation,
FileNetworkOpenInformation, FilePositionInformation, and FileAllInformation
_FILE_INFORMATION_CLASS requests.

-----Original Message-----
From: xxxxx@mail.aliroo.com [mailto:xxxxx@mail.aliroo.com]
Sent: Wednesday, August 09, 2000 03:59
To: File Systems Developers
Subject: [ntfsd] How to detect file SEEK operations on NT filter FSD

I’m writing a filter FSD.
Each file that is supposed to get processed has additional data (metadata)
at the end of the file stream which I add. The metadata isn’t supposed to
be ‘seen’ by the user/application.
The metadata structure can’t be part of the extended attributes because of
windows 95/98 compatibility.

I need to hide the existance of the metadata from the application which is
using the file so that when it accesses the file data,
it treats it like a regular file.
The problem is that when the application does a file seek operation
relative to the end of the file,
the NT calculates the file position without notifying my driver so I can’t
‘fix’ the position to ignore the metadata existance.

thanks for your help,
A.K.

You are currently subscribed to ntfsd as: xxxxx@digitaldelivery.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Hi guys.
Why not put your hidden information into the head of
the file. I think it is more easy to implement than to
put them into the tail of a file. Then you write hook code
for the open, close, seek, findfirstfile, findnextfile,
gotfileattrib, and so on.
Now I’m writing an encrypted file system by NTIFS.
I use the way. Very successful.
Good Lucky.

Regards
Jansen Zhu.
Shanghai China.

----- Original Message -----
From: Jerry Willett
To: File Systems Developers
Sent: Wednesday, August 09, 2000 9:52 PM
Subject: [ntfsd] RE: How to detect file SEEK operations on NT filter FSD

> You need to just the file size so that applications see the file size
> without your footer.
>
> You need to adjust the file size for IRP_MJ_DIRECTORY_CONTROL for the
> FileDirectoryInformation, FileFullDirectoryInformation, and
> FileBothDirectoryInformation _FILE_INFORMATION_CLASS requests.
>
> And for IRP_MJ_QUERY_INFORMATION for the FileStandardInformation,
> FileNetworkOpenInformation, FilePositionInformation, and FileAllInformation
> _FILE_INFORMATION_CLASS requests.
>
> -----Original Message-----
> From: xxxxx@mail.aliroo.com [mailto:xxxxx@mail.aliroo.com]
> Sent: Wednesday, August 09, 2000 03:59
> To: File Systems Developers
> Subject: [ntfsd] How to detect file SEEK operations on NT filter FSD
>
>
> I’m writing a filter FSD.
> Each file that is supposed to get processed has additional data (metadata)
> at the end of the file stream which I add. The metadata isn’t supposed to
> be ‘seen’ by the user/application.
> The metadata structure can’t be part of the extended attributes because of
> windows 95/98 compatibility.
>
> I need to hide the existance of the metadata from the application which is
> using the file so that when it accesses the file data,
> it treats it like a regular file.
> The problem is that when the application does a file seek operation
> relative to the end of the file,
> the NT calculates the file position without notifying my driver so I can’t
> ‘fix’ the position to ignore the metadata existance.
>
> thanks for your help,
> A.K.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@digitaldelivery.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@citiz.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

> Why not put your hidden information into the head of

the file. I think it is more easy to implement than to
put them into the tail of a file. Then you write hook code
for the open, close, seek, findfirstfile, findnextfile,
gotfileattrib, and so on.

Bad idea.
You will need to memmove() all paging reads from the file, thus decreasing
the performance tremendously.

Max

5

> The problem is that when the application does a file seek operation

relative to the end of the file,
the NT calculates the file position without notifying my driver so I can’t
‘fix’ the position to ignore the metadata existance.

Another problem I see here:

  • you can filter paging reads from user file mappings (MmIsRecursiveIoFault
    is FALSE) - to strip the metadata from the user mapping.
  • but! the same page is used for cache too. So, you will strip the metadata
    from the cache too. Is it OK?
  • if not - do not cache the metadata by stripping it from any inpage reads
    while using the noncached read requests to read the metadata from the lower
    FS.

Max

6

Yeah,
What you say is all right.
I wish to know how do you deal the
operation of append the data after
the tail of the file. and how do you
deal the operation “cutting file tail”
by writing file with zero length.
These operation will demage for you data
at the tail of your file.
Would you please let me know it, if you
have good idea.

Best Regards
Jansen Zhu.
----- Original Message -----
From: Maxim S. Shatskih
To: File Systems Developers
Sent: Sunday, August 13, 2000 7:35 AM
Subject: [ntfsd] RE: How to detect file SEEK operations on NT filter FSD

> > Why not put your hidden information into the head of
> > the file. I think it is more easy to implement than to
> > put them into the tail of a file. Then you write hook code
> > for the open, close, seek, findfirstfile, findnextfile,
> > gotfileattrib, and so on.
>
> Bad idea.
> You will need to memmove() all paging reads from the file, thus decreasing
> the performance tremendously.
>
> Max
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@citiz.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>