Memory Mapped Files

NTFSD
1

Hi All,

I am developing an encryption filter driver and would really like some help
on the correct way to handle memory mapped files.

At present my filter driver happily encrypts and decrypts data when not
accessed via memory mapped files. I am using notepad as my test app.

I understand that data in the cache should be left untouched so as not to
mess up other processes that could have mapped a view of the file.

My question is, how does the data get into the cache in the first place! I
have yet to see any kind of READ on the file when openened with notepad. So
how can I decrypt the data into the cache!

I Have set up filter callbacks on PreAcquireForSectionSynchronization and
PostAcquireForSectionSynchronization but these only serve to tell me that
someone is creating a section mapping of the file. I can`t access the data
from these functions.

Any suggestions as to where to look. Or am I being really stupid :wink:

Ben

2

Ben,

You are missing the I/O operations. Memory mapped file access is satisfied
by paging I/O. Of course, once in the cache, the data isn’t going to be
fetched from disk again - even after the file is closed and re-opened.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@des.co.uk [mailto:xxxxx@des.co.uk]
Sent: Wednesday, July 24, 2002 6:19 AM
To: File Systems Developers
Subject: [ntfsd] Memory Mapped Files

Hi All,

I am developing an encryption filter driver and would really like some help
on the correct way to handle memory mapped files.

At present my filter driver happily encrypts and decrypts data when not
accessed via memory mapped files. I am using notepad as my test app.

I understand that data in the cache should be left untouched so as not to
mess up other processes that could have mapped a view of the file.

My question is, how does the data get into the cache in the first place! I
have yet to see any kind of READ on the file when openened with notepad. So
how can I decrypt the data into the cache!

I Have set up filter callbacks on PreAcquireForSectionSynchronization and
PostAcquireForSectionSynchronization but these only serve to tell me that
someone is creating a section mapping of the file. I can`t access the data
from these functions.

Any suggestions as to where to look. Or am I being really stupid :wink:

Ben

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

3

Ben , I was so borred that I wrote more than 10k of “sheet” into a post
yesterday regarding this matter. Maybe you have to read it. Its just below
=)

wrote in message news:xxxxx@ntfsd…
>
>
> Hi All,
>
> I am developing an encryption filter driver and would really like some
help
> on the correct way to handle memory mapped files.
>
> At present my filter driver happily encrypts and decrypts data when not
> accessed via memory mapped files. I am using notepad as my test app.
>
> I understand that data in the cache should be left untouched so as not to
> mess up other processes that could have mapped a view of the file.
>
> My question is, how does the data get into the cache in the first place! I
> have yet to see any kind of READ on the file when openened with notepad.
So
> how can I decrypt the data into the cache!
>
> I Have set up filter callbacks on PreAcquireForSectionSynchronization and
> PostAcquireForSectionSynchronization but these only serve to tell me that
> someone is creating a section mapping of the file. I can`t access the data
> from these functions.
>
> Any suggestions as to where to look. Or am I being really stupid :wink:
>
> Ben
>
>
>

4

When the I/O manager sends IRP_MJ_READ with flags IRP_NOCAHE &
IRP_PAGING_IO, you can set a completion routine in the filter driver and
call the lower driver. The lower driver(normally FSD) will fetch the
contents from disk and your completion routine will be invoked. In the
completion routine the content should be decrypted so that the cache
contains decrypted content. Once the content is in cache subsequent read
requests are satisfied by the cache only.

Thanks
Surendra

5

Dan Partelly wrote:

Ben , I was so borred that I wrote more than 10k of “sheet” into a post
yesterday regarding this matter. Maybe you have to read it. Its just below
=)

Dan,
I might like to read your 10 pages too. But I can’t find them! Which
thread & date?

Thx
Andy

6

“On-the-fly encryption/decryption driver workflow” thread

-htfv

----- Original Message -----
From: “Andy Champ”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Thursday, July 25, 2002 11:21 AM
Subject: [ntfsd] Re: Memory Mapped Files

> Dan Partelly wrote:
>
> > Ben , I was so borred that I wrote more than 10k of “sheet” into a post
> > yesterday regarding this matter. Maybe you have to read it. Its just
below
> > =)
> >
> >
>
> Dan,
> I might like to read your 10 pages too. But I can’t find them! Which
> thread & date?
>
> Thx
> Andy
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>