Problem with memory mapped IO for notepad

Hello everyone,
I am working on the filesystem minifilter driver and making Encryption driver. I am having problem in reading data when it is read from notepad as notepad cached the data. Can I anyone help me how i can handle the notepad data in my minifilter driver. Which IRPs i have to intercept for notepad data. Currently I am intercepting IRP_MJ_READ and IRP_MJ_WRITE requests. I worked well for file opened with wordpad. I am manuplating data simply by xor operation.
Kindly help me in this regard.
Thanks.

Notepad uses memory mapped files, but those still show up in IRP_MJ_READ and IRP_MJ_WRITE calls.

Were I to hazard a guess, I’d bet you are doing your encryption (and decryption) in place. Since notepad uses the in-memory copy directly (versus copying to a separate buffer like the Read/Write APIs) it will see what you are doing to the buffer.

Bottom line: you have to use your own buffer for both read (due to dummy pages) and write (because that memory is visible to applications via the memory mapping API).

Tony
OSR