I have a modified swapbuffers sample which identifies the encrypted files on the file system (based on a header applied to them), and swaps the encrypted contend with decrypted content in the post-read callback of the minifilter.
the problem I encounter is:
The OS caches the content I swapped for the first time and I receive the cached content(which is the decrypted content) next time I process the file(in post read) instead of the disk content. But I expected an encrypted content and try decrypting it in the post operation, resulting the wrong content.
I tried setting the IRP_NOCACHE flag in Data->Iopb->IrpFlags(in pre-read callback), to force the OS to fetch the contents from the disk. But it does not solve the problem in all conditions. trying to read the file using notepad shows me the correct content. also copying the file using explorer results to a correct target file which works fine with applications. but trying to open the original file using some applications(in my case a PDF reader), the file fails to be processed. (maybe it fails to read or maybe it receives the wrong content.)
any idea or hint?