Issue about Minifilter and Memory Map, Encrypt/Decrypt

NTFSD
1

Hi all,

I’ve read archives but not found an exactly solution for this issues.
I think there are many people facing this problem.
Any expert can help?
If there’s any source code, please give a link.

Thanks,
Frank

2

I’m a newbie on driver development, and just getting the same issue as you.

This issue is introduced by applications like “notepad” which uses CreateFileMapping and MapViewOfFile. I spent at list 3 hours on google and reading the related discussions on this forum, but still not able to get an answer. I set breakpoint at IRP_MJ_ACQUIRE_FOR_SECTION_SYNC, but get nothing useful from this struct:
struct {
FS_FILTER_SECTION_SYNC_TYPE SyncType;
ULONG PageProtection;
} AcquireForSectionSynchronization;

I’m not sure if we can get any help if set callbacks on
IRP_MJ_RELEASE_FOR_SECTION_SYNC
IRP_MJ_ACQUIRE_FOR_CC_FLUSH
IRP_MJ_RELEASE_FOR_CC_FLUSH.

Even worse in my situation: I plan to add a header/meta data for each file during reading/writting. If applications use ReadFile/WriteFile, I can set new offset when encrypt/decrypt. But now how can I handle the memory mapped file?

BTW: I replied this post 2 hours ago, and was told that my post will appear in several minutes. But why still not posted?

3

I changed my keyword, and happened to find this article:
http://www.osronline.com/showThread.cfm?link=151746

the issue looks resolved. I have to sleep now, will try it tomorrow.

4

Thanks for your reply. I’m trying with CTX example.
Hope to get your update on this issue.

5

Can any expert help?
I’ve tried with File Context (add the file context (Data->Iopb->TargetFileObject->FsContext) in a list when creating (IRP_MJ_CREATE), and remove from the list when closing (IRP_MJ_CLOSE)), but could not solve the issue.
Thanks a lot.

6

I don’t think you stated the problem anywhere (or at least I’m missing that post).

However, in a minifilter you don’t need to (and most likely you shouldn’t) manage contexts yourself, filter manager will do that for you. See “Managing Contexts” in MSDN (currently at http://msdn.microsoft.com/en-us/library/aa488090.aspx).

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

7

Thanks Alex and Paul for your replies.
But so far I haven’t found any article to fix this problem.
Can any expert help me?

Thanks a lot.