How to tackle memory mapped file in encryption file filter driver ?

NTFSD
1

Having read a lot of messages about memory mapped files. I still cannot
figure out which is the best way to solve the problem - how to terminate
the mapped file cache ??

Below shows a scenario of my driver having the aforementioned problem:

  1. Load the filter driver (developed based on Filemon sample from
    SysInternal)
  2. Open an encrypted file by MS Notepad to read -> [ get original content
    :slight_smile: ]
  3. Close Notepad
  4. Unload the filter driver
  5. Open the encrypted file by Notepad again -> [ get original content :frowning:
    ]

Any expertise, please advise me with a more PRACTICAL and COMPREHENSIVE
solution.

Thanks and Regards,

– Philip

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

> Having read a lot of messages about memory mapped files. I still cannot

figure out which is the best way to solve the problem - how to terminate
the mapped file cache ??

Below shows a scenario of my driver having the aforementioned problem:

  1. Load the filter driver (developed based on Filemon sample from
    SysInternal)
  2. Open an encrypted file by MS Notepad to read -> [ get original content
    :slight_smile: ]
  3. Close Notepad
  4. Unload the filter driver
  5. Open the encrypted file by Notepad again -> [ get original content :frowning:
    ]

Issue a Win 32 API FlushFileBuffers for the drive which contains the file.
(Get the file handle of the drive using CreateFile). You will get the
encrypted content.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

> figure out which is the best way to solve the problem - how to terminate

the mapped file cache ??

You cannot.
See Rajeev Nagar’s book.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com