my filter changes size, MS word does not work well

NTFSD
1

Hi all,
I have an encryption filter which adds a header to an encrypted file.
Upon read operation it shifts read offset. the data received is fine and matches the original (istead of additional zeros at the end) but MS word fails to open the file. However if I choose the recover option it can recover the file.

In my read callback I am always completing the operation with reduced size of bytesRead when file is read.

Data->IoStatus.Status = STATUS_SUCCESS;
Data->IoStatus.Information = bytesRead;
return FLT_PREOP_COMPLETE;

Any helpful comment is appreciated.

2

The Office applications also use a combination of the file information
and directory enumeration requests to determine the file size. Are you
correctly adjusting the sizes in these requests to reflect the true file
sizes?

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@yahoo.com
To: “Windows File Systems Devs Interest List”
Sent: 6/12/2017 4:14:48 AM
Subject: [ntfsd] my filter changes size, MS word does not work well

>Hi all,
>I have an encryption filter which adds a header to an encrypted file.
>Upon read operation it shifts read offset. the data received is fine
>and matches the original (istead of additional zeros at the end) but MS
>word fails to open the file. However if I choose the recover option it
>can recover the file.
>
>In my read callback I am always completing the operation with reduced
>size of bytesRead when file is read.
>
> Data->IoStatus.Status = STATUS_SUCCESS;
> Data->IoStatus.Information = bytesRead;
> return FLT_PREOP_COMPLETE;
>
>Any helpful comment is appreciated.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

3

Thanks for replying.

Are you correctly adjusting the sizes in these requests to reflect the true file sizes?

No. I am not.

I wanted to know if there is any trick to do in read callback or I have to go for dir enum and etc. which I appears I have to.

4

I think you need to handle this “IRP_MJ_DIRECTORY_CONTROL” with minior “IRP_MN_QUERY_DIRECTORY” irp along with these:
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileIdBothDirectoryInformation
and this you may bypass “IRP_MN_NOTIFY_CHANGE_DIRECTORY”.

Hope this may help.

.nT