Issue about Minifilter and Memory Map, Encrypt/Decrypt

Hi all,

I’ve read archives but not found an exactly solution for this issues.
I think there are many people facing this problem.
Any expert can help?
If there’s any source code, please give a link.


I’m a newbie on driver development, and just getting the same issue as you.

This issue is introduced by applications like “notepad” which uses CreateFileMapping and MapViewOfFile. I spent at list 3 hours on google and reading the related discussions on this forum, but still not able to get an answer. I set breakpoint at IRP_MJ_ACQUIRE_FOR_SECTION_SYNC, but get nothing useful from this struct:
struct {
ULONG PageProtection;
} AcquireForSectionSynchronization;

I’m not sure if we can get any help if set callbacks on

Even worse in my situation: I plan to add a header/meta data for each file during reading/writting. If applications use ReadFile/WriteFile, I can set new offset when encrypt/decrypt. But now how can I handle the memory mapped file?

BTW: I replied this post 2 hours ago, and was told that my post will appear in several minutes. But why still not posted?

I changed my keyword, and happened to find this article:

the issue looks resolved. I have to sleep now, will try it tomorrow.

Thanks for your reply. I’m trying with CTX example.
Hope to get your update on this issue.

Can any expert help?
I’ve tried with File Context (add the file context (Data->Iopb->TargetFileObject->FsContext) in a list when creating (IRP_MJ_CREATE), and remove from the list when closing (IRP_MJ_CLOSE)), but could not solve the issue.
Thanks a lot.

I don’t think you stated the problem anywhere (or at least I’m missing that post).

However, in a minifilter you don’t need to (and most likely you shouldn’t) manage contexts yourself, filter manager will do that for you. See “Managing Contexts” in MSDN (currently at

This posting is provided “AS IS” with no warranties, and confers no rights.

Thanks Alex and Paul for your replies.
But so far I haven’t found any article to fix this problem.
Can any expert help me?

Thanks a lot.