How to emulate file size

NTFSD
1

I’m going to develop an encryption/decryption filter driver for W2K. Since,
I’ve to add a header at the beginning of each encrypted files. How I can
emulate the file size of the encrypted file, so that the OS still get the
original file size instead of the encrypted file size (i.e. original file
size + header size) ?

Thanks & Regards,

Philip

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Well, if you’re going to filter it anyway, intercept requests for which
the file size matter (off the top of my head, on open, get file
information, and close) and simply plug in the numbers you want user
mode to know. Exact details are left as an exercise for the reader. I
think you’ll also need to adjust offsets in at least reads, seeks, and
random writes - but I’ve only thought about the problem for as long as
it’s taken me to type this, so I’ve forgotten something.

At first blush, this would probably have me making the information block
a file trailer, rather than a header. That way I don’t have to dork with
offsets, and I’m modifying information on low-performance operations
rather than read/write. I can cache the information on file open and
write back on file extent. Note that it wouldn’t reliably work to write
back only on close (if the system crashes…). I’d probably also cache a
“encryption information” file that I hid from the system that contained
the header information just in case.

…dave

My opinion only, and it’s worth what you pay for it.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Hong
Sent: Sunday, February 10, 2002 6:36 AM
To: File Systems Developers
Subject: [ntfsd] How to emulate file size

I’m going to develop an encryption/decryption filter driver
for W2K. Since,
I’ve to add a header at the beginning of each encrypted
files. How I can
emulate the file size of the encrypted file, so that the OS
still get the
original file size instead of the encrypted file size (i.e.
original file
size + header size) ?

Thanks & Regards,

Philip

You are currently subscribed to ntfsd as: xxxxx@exmsft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

The difficult case for any filter that attempts to manipulate data sizes in
the file systems is memory mapped files - the size information comes from
the VM system, not the file system. While the VM system gets the initial
size from the file system (via an IRP_MJ_QUERY_INFORMATION) the file system
reports any subsequent file size changes to the VM system using a
programmatic interface (CcSetFileSize as I recall.)

Of course, many applications only use the read/write interface. Notepad,
however, uses the memory mapped API and is thus a great test application for
a filter driver of this type.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: David Beaver [mailto:xxxxx@exmsft.com]
Sent: Sunday, February 10, 2002 2:12 PM
To: File Systems Developers
Subject: [ntfsd] RE: How to emulate file size

Well, if you’re going to filter it anyway, intercept requests for which
the file size matter (off the top of my head, on open, get file
information, and close) and simply plug in the numbers you want user
mode to know. Exact details are left as an exercise for the reader. I
think you’ll also need to adjust offsets in at least reads, seeks, and
random writes - but I’ve only thought about the problem for as long as
it’s taken me to type this, so I’ve forgotten something.

At first blush, this would probably have me making the information block
a file trailer, rather than a header. That way I don’t have to dork with
offsets, and I’m modifying information on low-performance operations
rather than read/write. I can cache the information on file open and
write back on file extent. Note that it wouldn’t reliably work to write
back only on close (if the system crashes…). I’d probably also cache a
“encryption information” file that I hid from the system that contained
the header information just in case.

…dave

My opinion only, and it’s worth what you pay for it.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Hong
Sent: Sunday, February 10, 2002 6:36 AM
To: File Systems Developers
Subject: [ntfsd] How to emulate file size

I’m going to develop an encryption/decryption filter driver
for W2K. Since,
I’ve to add a header at the beginning of each encrypted
files. How I can
emulate the file size of the encrypted file, so that the OS
still get the
original file size instead of the encrypted file size (i.e.
original file
size + header size) ?

Thanks & Regards,

Philip

You are currently subscribed to ntfsd as: xxxxx@exmsft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

You seem to assume that all streams are named - they are not. The DEFAULT
stream has a null name. NTFS represents such streams using the colon
syntax:

::

When you open just the file name, with no stream or attribute name, you are
opening ::$DATA. For example, from the command line try the
following syntax on a file in an NTFS file system:

More < file::$DATA

(Interesting note - if you try “more file::$DATA” it fails because the
command appears to reject names with embedded colons. But when you use
redirection, it is the shell that handles the name, and it happily allows
stream names.)

Thus, the stream name in this case will be NULL, and will have no length.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Philip Hong [mailto:xxxxx@issl.com.hk]
Sent: Saturday, February 09, 2002 9:01 PM
To: File Systems Developers
Subject: [ntfsd] RE: How to emulate file size

Actually, I want to “cheat” Windows OS. I’m using Filemon from SysInternals
as the base. I found that a “FileStreamInformation” type of information can
be intercepted in IRP_MJ_QUERY_INFORMATION whenever using right-click to
query the properties of a file. Then, I follow the code in Rajeev’s book
trying to get information like “StreamNameLength” from
FILE_STREAM_INFORMATION structure, just like the code below:

…

case IRP_MJ_QUERY_INFORMATION:
DbgPrint(“IRP_MJ_QUERY_INFORMATION - %s, %s\n”, fullPathName,
FileInformation[currentIrpStack->Parameters.QueryFile.FileInformationClass])
;

ptrSystemBuffer = Irp->AssociatedIrp.SystemBuffer;

if (currentIrpStack->Parameters.QueryFile.FileInformationClass ==
FileStreamInformation)
{
ptrStandardInfo = (PFILE_STREAM_INFORMATION)ptrSystemBuffer;
DbgPrint(“StreamNameLength = %lx\n”,
ptrStandardInfo->StreamNameLength);
}
break;

…

However, ptrStandardInfo->StreamNameLength always returns zero.

Is there something wrong in my code or in my concept ?
Can I simply set the StreamNameLength to “cheat” the OS ?

Please help. Thanks & Regards,

– Philip

—
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

The task will be much simpler if the header will be exactly 1 page in size.

----- Original Message -----
From: “Philip Hong”
To: “File Systems Developers”
Sent: Sunday, February 10, 2002 6:35 AM
Subject: [ntfsd] How to emulate file size

> I’m going to develop an encryption/decryption filter driver for W2K. Since,
> I’ve to add a header at the beginning of each encrypted files. How I can
> emulate the file size of the encrypted file, so that the OS still get the
> original file size instead of the encrypted file size (i.e. original file
> size + header size) ?
>
> Thanks & Regards,
>
> Philip
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com