Problem of MJ_WRITE about CACHE && NOCACHE ?

NTFSD
1

Hi,

I tracked normal IRP_MJ_WRITE behavior.

for example, if I open a file with 7 bytes(in FAT32 FS), then I add 2 bytes into it, when I save the file, I will receive 3 MJ_WRITE.

1st MJ_WRITE: IRP_CACHE, write.length=9;
2nd MJ_WRITE: IRP_NOCACHE, write.Length=4096;
3rd MJ_WRITE: IRP_NOCACHE, write.Length=4096;

If I encrypt the data before it is sent to FSD, which MJ_WRITE shuld I handle?3ks!

2

You cannot encrypt data that is sent from the application to the FSD via
cached I/O - it means you will expose encrypted data to memory mapping
applications and/or miss memory mapped I/O.

You should encrypt non-cached I/O operations. You should not encrypt in
place because the memory passed in a paging write is still visible to
application programs. But all of this has been discussed in the forum
numerous times - I would suggest reading the archives.

Encryption filters are challenging to implement. Asking questions of
this type suggests you do not have even the basic level of understanding
necessary to consider implementing an encryption filter, let alone
actually doing so successfully. While this might seem harsh to you, I
would rather make sure you understand how far you are from your goal
than have you spend the next year or two feeling frustrated because you
cannot make your filter work properly.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

3

>>1st MJ_WRITE: IRP_CACHE, write.length=9;

I don’t think there is flag IRP_CACHE, do you mean there is no IRP_NOCACHE flag being set in the IRP?

No IRP_NOCACHE flag DOESN’T guarantee the operation must be done on cache by FSD. The data may read from or written to the disk. The issue was well discussed already. It seems no easy solution just on basis of filter driver. As it was said, a FSD layer will be neccessary?

4

> If I encrypt the data before it is sent to FSD, which MJ_WRITE shuld I
handle?

Noncached ones.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

5

Hi,

But in Noncached ones, I can only get iopb->Paramerters.Write.Length=4096, it is NOT the real length of file.