stream file objects and decryption

NTFSD
1

Hi,
I understand (for the most part) the implications of stream file objects and
their complicating effects on context tracking and knowing when it is safe
to discard per-FCB data structs. What I am not clear on is whether, if I am
a decryption filter (read-only at the moment) concerned with decrypting data
on its way to user space, I need to be concerned with read operations
against those fabricated stream objects. Will all the reads of significance
I need to concern myself with (for decryption purposes) come through the
fileObjects that were created specifically via IRP_MJ_CREATE that stemmed
from an application opening the target file? Currently, I simply key in on
the non-cache path, regardless of FO_STREAM_FILE or not. I’m looking to
clean up my context tracking a bit and was wondering about the implication
of FO_STREAM_FILE with respect to the decrypt path (non-cache).

Thanks,
Bill

2

You have to work on stream FOs too.

Regards, Dejan.

Bill Wilhelm wrote:

Hi,
I understand (for the most part) the implications of stream file objects and
their complicating effects on context tracking and knowing when it is safe
to discard per-FCB data structs. What I am not clear on is whether, if I am
a decryption filter (read-only at the moment) concerned with decrypting data
on its way to user space, I need to be concerned with read operations
against those fabricated stream objects. Will all the reads of significance
I need to concern myself with (for decryption purposes) come through the
fileObjects that were created specifically via IRP_MJ_CREATE that stemmed
from an application opening the target file? Currently, I simply key in on
the non-cache path, regardless of FO_STREAM_FILE or not. I’m looking to
clean up my context tracking a bit and was wondering about the implication
of FO_STREAM_FILE with respect to the decrypt path (non-cache).

Thanks,
Bill

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.