Memory Mapped files and filter driver

NTFSD
1

Hi,

I am writing a filter driver which perform encrytion and decryption on
certain files. I can perform this functions without problem on some files,
but it fails when i use the same thing on memory mapped files. I am using
simple IRP_MJ_READ dispatch routine to intercept the read request. What i
have to do to take care of memory mapped files and how to access data and
intercept when this file is accessed?

Thanks
Suhail

Watch the online reality show Mixed Messages with a friend and enter to win
a trip to NY
http://www.msnmessenger-download.click-url.com/go/onm00200497ave/direct/01/

2

You must intercept noncached IO only.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Suhail Ansari”
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, June 15, 2004 7:01 PM
Subject: [ntfsd] Memory Mapped files and filter driver

> Hi,
>
> I am writing a filter driver which perform encrytion and decryption on
> certain files. I can perform this functions without problem on some files,
> but it fails when i use the same thing on memory mapped files. I am using
> simple IRP_MJ_READ dispatch routine to intercept the read request. What i
> have to do to take care of memory mapped files and how to access data and
> intercept when this file is accessed?
>
>
> Thanks
> Suhail
>
> _________________________________________________________________
> Watch the online reality show Mixed Messages with a friend and enter to win
> a trip to NY
> http://www.msnmessenger-download.click-url.com/go/onm00200497ave/direct/01/
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

It is most probable that you do not intercept
the paging IO reads/writes. This is when the memory mapped file
is read/written from/to disc.

L.

4

Hi,

In my code for IRP_MJ_READ i did this

if(Irp->Flags & IRP_NOCACHE)
{
///perform decryption
}

but what i see is that when i try to open a file like .rtf in wordpad there
are some calls to FAST/IO dispatch routine and there are no calls to my
IRP_MJ_READ dispatch routine. Is there something that i am doing wrong here.

Thanks for you help.

Suhail

From: “Maxim S. Shatskih”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: Re: [ntfsd] Memory Mapped files and filter driver
>Date: Tue, 15 Jun 2004 19:32:24 +0400
>
> You must intercept noncached IO only.
>
>Maxim Shatskih, Windows DDK MVP
>StorageCraft Corporation
>xxxxx@storagecraft.com
>http://www.storagecraft.com
>
>
>----- Original Message -----
>From: “Suhail Ansari”
>To: “Windows File Systems Devs Interest List”
>Sent: Tuesday, June 15, 2004 7:01 PM
>Subject: [ntfsd] Memory Mapped files and filter driver
>
>
> > Hi,
> >
> > I am writing a filter driver which perform encrytion and decryption on
> > certain files. I can perform this functions without problem on some
>files,
> > but it fails when i use the same thing on memory mapped files. I am
>using
> > simple IRP_MJ_READ dispatch routine to intercept the read request. What
>i
> > have to do to take care of memory mapped files and how to access data
>and
> > intercept when this file is accessed?
> >
> >
> > Thanks
> > Suhail
> >
> >
> > Watch the online reality show Mixed Messages with a friend and enter to
>win
> > a trip to NY
> >
>http://www.msnmessenger-download.click-url.com/go/onm00200497ave/direct/01/
> >
> >
> > —
> > Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
FREE pop-up blocking with the new MSN Toolbar – get it now!
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

5

This is OK, since in some cases the whole file is in the cache.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Suhail Ansari”
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, June 15, 2004 8:47 PM
Subject: Re: [ntfsd] Memory Mapped files and filter driver

> Hi,
>
> In my code for IRP_MJ_READ i did this
>
> if(Irp->Flags & IRP_NOCACHE)
> {
> ///perform decryption
> }
>
> but what i see is that when i try to open a file like .rtf in wordpad there
> are some calls to FAST/IO dispatch routine and there are no calls to my
> IRP_MJ_READ dispatch routine. Is there something that i am doing wrong here.
>
> Thanks for you help.
>
> Suhail
>
>
> >From: “Maxim S. Shatskih”
> >Reply-To: “Windows File Systems Devs Interest List”
> >To: “Windows File Systems Devs Interest List”
> >Subject: Re: [ntfsd] Memory Mapped files and filter driver
> >Date: Tue, 15 Jun 2004 19:32:24 +0400
> >
> > You must intercept noncached IO only.
> >
> >Maxim Shatskih, Windows DDK MVP
> >StorageCraft Corporation
> >xxxxx@storagecraft.com
> >http://www.storagecraft.com
> >
> >
> >----- Original Message -----
> >From: “Suhail Ansari”
> >To: “Windows File Systems Devs Interest List”
> >Sent: Tuesday, June 15, 2004 7:01 PM
> >Subject: [ntfsd] Memory Mapped files and filter driver
> >
> >
> > > Hi,
> > >
> > > I am writing a filter driver which perform encrytion and decryption on
> > > certain files. I can perform this functions without problem on some
> >files,
> > > but it fails when i use the same thing on memory mapped files. I am
> >using
> > > simple IRP_MJ_READ dispatch routine to intercept the read request. What
> >i
> > > have to do to take care of memory mapped files and how to access data
> >and
> > > intercept when this file is accessed?
> > >
> > >
> > > Thanks
> > > Suhail
> > >
> > >
> > > Watch the online reality show Mixed Messages with a friend and enter to
> >win
> > > a trip to NY
> > >
> >http://www.msnmessenger-download.click-url.com/go/onm00200497ave/direct/01/
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> FREE pop-up blocking with the new MSN Toolbar ? get it now!
> http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com