How to resove the overwrite problem??

NTFSD
1

Hi, my program includes two parts. App and filter driver program.

in app, it set encryption folder and encryption key. these encryption info
is save in registry.

in filter driver program, it reads encryption info from registry, and
encrypt or decrypt the files in the encryption folder.

now, encryption and decryption function is right, but when i overwrite a
file in the encryption folder, the overwrite operation is not be executed,
How can i resove the overwrite problem???

Thank you.

2

You really need to provide a lot more information…

·åÒ¦ wrote:

Hi, my program includes two parts. App and filter driver program.

in app, it set encryption folder and encryption key. these encryption
info
is save in registry.

in filter driver program, it reads encryption info from registry, and
encrypt or decrypt the files in the encryption folder.

now, encryption and decryption function is right, but when i overwrite
a
file in the encryption folder, the overwrite operation is not be
executed,
How can i resove the overwrite problem???

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

3

A lot more information is provided as follows:

firstly, in SfCreate rountine, Check the FILE_OVERWRITE flag.

//Code
SfCreate(…)
{
…
disposition = (IrpSp->Parameters.Create.Options>> 24) & 0xFF;

// Wait for completion
ULONG_PTR information = Irp->IoStatus.Information;
BOOLEAN replaced = FALSE;
switch( disposition ) {
case FILE_OVERWRITE_IF:
case FILE_OVERWRITE:

if( information == FILE_OVERWRITTEN )
{
replaced = TRUE;
}
}
…

After i get the flag, how and where can i deal with the overwrite
operation???

thanks!

4

A lot more information is provided as follows:

firstly, in SfCreate rountine, Check the FILE_OVERWRITE flag.

//Code
SfCreate(…)
{
…
disposition = (IrpSp->Parameters.Create.Options>> 24) & 0xFF;

// Wait for completion
ULONG_PTR information = Irp->IoStatus.Information;
BOOLEAN replaced = FALSE;
switch( disposition ) {
case FILE_OVERWRITE_IF:
case FILE_OVERWRITE:

if( information == FILE_OVERWRITTEN )
{
replaced = TRUE;
}
}
…

After i get the flag, how and where can i deal with the overwrite
operation???

thanks!

On 8/27/07, Dejan Maksimovic wrote:
>
>
> You really need to provide a lot more information…
>
> ??Ҧ wrote:
>
> > Hi, my program includes two parts. App and filter driver program.
> >
> > in app, it set encryption folder and encryption key. these encryption
> > info
> > is save in registry.
> >
> > in filter driver program, it reads encryption info from registry, and
> > encrypt or decrypt the files in the encryption folder.
> >
> > now, encryption and decryption function is right, but when i overwrite
> > a
> > file in the encryption folder, the overwrite operation is not be
> > executed,
> > How can i resove the overwrite problem???
> >
>
> –
> Kind regards, Dejan
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

The code you’ve sent should simply be:
if(IoStatus.Information == FILE_OVERWRITTEN)
in the completion routine. (you need not check Disposition)
You can be sure the file is overwritten if the above line is true in
the Create Completion. What you want to do with it after… is your
choice. I still don’t understand what you want to do;)
You can deal with the overwrite… anywhere… but in the completion
the overwrite is already executed.

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.