How to Modify the User Buffer ??

NTFSD
1

Hello ,

I’m writing a file system filter driver for encryption and decryption purpose. I used the sfilter sample from IFS Kit
sample programs. Can any body tell me where is the exact place to modify the Buffer ? I’ve modified the SfFastIoRead
function to get the READ buffer and after that I’m modifying the buffer, but its not working.Simlarly i wanna modify the
write buffer also …Is SfFastIoWrite is the good place to write the modification code ?

1> Do i need to implement my OWN IRP_MJ_READ and IRP_MJ_WRITE ?
2> during the modification of buffer can i change the length of the Buffer also ?

My second set of question is : Can i call CRYPTO API function from filter driver ? If not please tell me the method , how to
make a kernel mode dll ( or any other method to access User Mode Application ) to communicate with the filter driver ( both ways ).

Regards
Deepak

2

> SfFastIoRead

function to get the READ buffer and after that I’m modifying the buffer,
but its not working.

You must deal with paging IO reads and writes,
FastIoRead/Write and cached reads/writes is bad.

My second set of question is : Can i call CRYPTO API
function from filter driver ? If not please tell me the method,

This has been discussed here two or three days ago.
If you are member of this forum at least a week,
you must have seen it. If not, find it in the recens posts.

L.

3

> sample programs. Can any body tell me where is the exact place to modify the
Buffer ? I’ve

Write path cannot modify the buffer for obvious reasons. Allocate your own
buffer for ciphertext and encrypt there.

My second set of question is : Can i call CRYPTO API function from filter
driver ?

You cannot. The possible solutions are:

a) re-implementing your own crypto code in the kernel by copy-paste from
freeware reference implementations (like the MD5 RFC).
b) use undocumented fips.sys which is a kernel CryptoAPI
c) use inverted call path to user mode

I would use the a) approach. Lesser amount of debugging and least complexity.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com