Query Regarding Reading the file from disk

Hey All,

I am writing a FSFD (encryption - dectryption) for windows
and facing a strange problem. Below is the step I am performing

  1. I am trying to open an encrypted word file (.doc) file for
    Winword application. This file is encrypted and has a user define tag
    for the identification.

  2. When file open call come at NtCreateFile from winword I stop
    it and signals to a “My-Win32-Application.Exe” for verifying the tag and
    if verified remove the tag from the file so that winword could see only
    encrypted file (no tag). And then release the call from NtCreateFile so
    that winword continue to do it’s operations.

  3. And at IRP_READ_COMPLETION call from winword and I am
    decrypting the read data, so that user can see plain text.

  4. Now the problem is while removing the tag from file
    with"My-Win32-Application.Exe", if I provide some delay before releasing
    NtCreateFile call everything works smooth. But if I don’t provide that
    delay word is getting encrypted data.

  5. Before releasing NtCreateFile, I am Flushing the data so that
    no lazi-writing required by the system.

Please suggest why could system behaving in such a manner.

Thanks & Regards,

Maitri Ved

============================================================================================================================

Disclaimer:

This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.

============================================================================================================================

Hey All,
I am writing a FSFD (encryption - dectryption) for windows and facing a strange problem. Below is the step I am performing

  1. I am trying to open an encrypted word file (.doc) file for Winword application. This file is encrypted and has a user define tag for the identification.
  2. When file open call come at NtCreateFile from winword I stop it and signals to a ?My-Win32-Application.Exe? for verifying the tag and if verified remove the tag from the file so that winword could see only encrypted file (no tag). And then release the call from NtCreateFile so that winword continue to do it?s operations.
  3. And at IRP_READ_COMPLETION call from winword and I am decrypting the read data, so that user can see plain text.
  4. Now the problem is while removing the tag from file with?My-Win32-Application.Exe?, if I provide some delay before releasing NtCreateFile call everything works smooth. But if I don?t provide that delay word is getting encrypted data.
  5. Before releasing NtCreateFile, I am Flushing the data so that no lazi-writing required by the system.

Please suggest why could system behaving in such a manner.

Thanks & Regards,

Maitri Ved

Hey All,

I am writing a FSFD (encryption - dectryption) for windows
and facing a strange problem. Below is the step I am performing

  1. I am trying to open an encrypted word file (.doc) file for
    Winword application. This file is encrypted and has a user define tag
    for the identification.

  2. When file open call come at NtCreateFile from winword I stop
    it and signals to a “My-Win32-Application.Exe” for verifying the tag and
    if verified remove the tag from the file so that winword could see only
    encrypted file (no tag). And then release the call from NtCreateFile so
    that winword continue to do it’s operations.

  3. And at IRP_READ_COMPLETION call from winword and I am
    decrypting the read data, so that user can see plain text.

  4. Now the problem is while removing the tag from file
    with"My-Win32-Application.Exe", if I provide some delay before releasing
    NtCreateFile call everything works smooth. But if I don’t provide that
    delay word is getting encrypted data.

  5. Before releasing NtCreateFile, I am Flushing the data so that
    no lazi-writing required by the system.

Please suggest why could system behaving in such a manner.

Thanks & Regards,

Maitri Ved

============================================================================================================================

Disclaimer:

This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.

============================================================================================================================

Hey All,

I am writing a FSFD (encryption - dectryption) for windows
and facing a strange problem. Below is the step I am performing

  1. I am trying to open an encrypted word file (.doc) file for
    Winword application. This file is encrypted and has a user define tag
    for the identification.

  2. When file open call come at NtCreateFile from winword I stop
    it and signals to a “My-Win32-Application.Exe” for verifying the tag and
    if verified remove the tag from the file so that winword could see only
    encrypted file (no tag). And then release the call from NtCreateFile so
    that winword continue to do it’s operations.

  3. And at IRP_READ_COMPLETION call from winword and I am
    decrypting the read data, so that user can see plain text.

  4. Now the problem is while removing the tag from file
    with"My-Win32-Application.Exe", if I provide some delay before releasing
    NtCreateFile call everything works smooth. But if I don’t provide that
    delay word is getting encrypted data.

  5. Before releasing NtCreateFile, I am Flushing the data so that
    no lazi-writing required by the system.

Please suggest why could system behaving in such a manner.

Thanks & Regards,

Maitri Ved

============================================================================================================================

Disclaimer:

This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.

============================================================================================================================