How to distort the file content read by user mode app in a filter driver?

NTFSD
1

Hi, everyone:

I want to distort the file content read by user mode app in my filter driver. For example,
there is a file “a.txt” which content is “abcde”, when “a.txt” is opened with nodepad, it will display “xxxxx” instead of “abcde”. Could anyone please tell me how can I do it in my filter driver?

2

Are you trying to do this for every application or only a specific one?
Also, for some files, all files, or what? Finally, are there rules for the
distortion? If this is for some apps, and there are rules for the
distortion, go to the archives and start reading about encryption filtes.
If you have a simpler scheme in mind, tell the group and we may be able to
give a suggestion.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

wrote in message news:xxxxx@ntfsd…
> Hi, everyone:
>
> I want to distort the file content read by user mode app in my filter
> driver. For example,
> there is a file “a.txt” which content is “abcde”, when “a.txt” is opened
> with nodepad, it will display “xxxxx” instead of “abcde”. Could anyone
> please tell me how can I do it in my filter driver?
>

3

I am sorry to have missed writing some details about my project.
Here are the specifications concerned with the project .

Driver Type : Mini-Filter

Handling Object : Document files.(Text file, Word doc file, Excel file…)

Distortion Apps : Text Editor(NOTEPAD, WORDPAD), MS Office Application(WORD, EXCEL…)

Distortion rules : To distort the content read from the File into specified string.
For example,if the specified strings is “Dummy data was read from this file.”
when files are opened by the Apps shown above, the specified strings will be
displayed in the Apps’ UI.

Thanks.

4

xxxxx@psh.com.cn wrote:

Distortion rules : To distort the content read from the File into specified string.
For example,if the specified strings is “Dummy data was read from this file.”
when files are opened by the Apps shown above, the specified strings will be
displayed in the Apps’ UI.

That really is no different in effect (and in complexity) to an
encryption driver, just in the opposite direction. See about 80% of the
traffic on this list for details :stuck_out_tongue:

In your case you could shortcut though eg. return STATUS_REPARSE and
point to a file containing that text. Determining what app has opened
your file isn’t reliable enough to be usable though… there are about a
million ways around such checks.

Tony