Hello,everyone! First,Sorry for my poor English!
I Write the transparent encryption,and it is worked well in the
notepad,wordpad,but has someting wrong in WINWORD.EXE.
The transparent encryption is based on sfilter
here is my code(attention:the IRP_WRITE_OPERATION|IRP_DEFER_IO_COMPLETION is
uncomment)
SF_RET OnSfilterIrpPre(IN PDEVICE_OBJECT DeviceObject,
IN PDEVICE_OBJECT NextObject,
IN PVOID Extension,
IN PIRP Irp,
OUT NTSTATUS *Status,
PVOID *Context)
{
…
else if (pIrpSp->MajorFunction==IRP_MJ_READ&&(Irp->Flags &
(IRP_PAGING_IO|IRP_SYNCHRONOUS_PAGING_IO|IRP_NOCACHE/*|IRP_READ_OPERATION|IRP_DEFER_IO_COMPLETION*/)))
{
//cfFileCacheClear(pFileObject);
TEFS_ReadPre(Irp,pIrpSp);
//2010-12-18
return SF_IRP_GO_ON;
//return SF_IRP_PASS;
}
else if (pIrpSp->MajorFunction==IRP_MJ_WRITE&&(Irp->Flags &
(IRP_PAGING_IO|IRP_SYNCHRONOUS_PAGING_IO|IRP_NOCACHE/*|IRP_WRITE_OPERATION|IRP_DEFER_IO_COMPLETION*/)))
{
if (TEFS_WritePre(Irp,pIrpSp,Context))
{
//2010-12-18
return SF_IRP_GO_ON;
//return SF_IRP_PASS;
}
else
{
KdPrint((“TEFS_WritePre Failed!”));
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return SF_IRP_COMPLETED;
}
}
…
}
VOID TEFS_ReadPre(IN PIRP irp,
IN PIO_STACK_LOCATION irpsp)
{
PLARGE_INTEGER offset;
PFILE_OBJECT pFileObject=(PFILE_OBJECT)irpsp->FileObject;
PFCB fcb = (PFCB)irpsp->FileObject->FsContext;
offset = &irpsp->Parameters.Read.ByteOffset;
if(offset->LowPart == FILE_USE_FILE_POINTER_POSITION
&& offset->HighPart == -1)
{
pFileObject->CurrentByteOffset.QuadPart+=HEAD_SIZE;
return;
}
offset->QuadPart += HEAD_SIZE;
}
BOOLEAN TEFS_WritePre(PIRP irp,PIO_STACK_LOCATION irpsp, PVOID *context)
{
PLARGE_INTEGER offset;
ULONG length = irpsp->Parameters.Write.Length;
PFILE_OBJECT pFileObject=(PFILE_OBJECT)irpsp->FileObject;
offset = &irpsp->Parameters.Write.ByteOffset;
if(offset->LowPart == FILE_USE_FILE_POINTER_POSITION
&& offset->HighPart == -1)
{
pFileObject->CurrentByteOffset.QuadPart+=HEAD_SIZE;
return TRUE;
}
else if (offset->LowPart == FILE_WRITE_TO_END_OF_FILE&&offset->HighPart
== -1 )
{
return TRUE;
}
else
{
offset->QuadPart += HEAD_SIZE;
return TRUE;
}
return FALSE;
}
The result:
IRP_MJ_READ can offset HEAD_SIZE,but IRP_MJ_WRITE can’t.
When I add the IRP_WRITE_OPERATION|IRP_DEFER_IO_COMPLETION,and the
IRP_MJ_WRITE can offset HEAD_SIZE,but IRP_MJ_READ will offset (2*HEAD_SIZE) I
used FileSpy to trace the winword,and there is a Write Operation with the
Flag=00000A00( IRP_WRITE_OPERATION|IRP_DEFER_IO_COMPLETION),Someone
said IRP_WRITE_OPERATION|IRP_DEFER_IO_COMPLETION
will become one of IRP_PAGING_IO|IRP_SYNCHRONOUS_PAGING_IO|IRP_NOCACHE at
last.But I can’t See it in FileSpy, So How can I fix this problem?Thank you!