hi all,
To estimate a file should be process or not,i set a flag in streamhandle
context when file was creating,use it in write or read routine,at last set
encrypted flag in cleanup routine if required,is this a correctly
way?now,there are these issues:
1,if the write irp flag contain IRP_DEFER_IO_COMPLETION,i should process
this irp or not?
2,sometims,i can’t catch any non_cached write irp when a app writting
file,all of them are cached.
3,how to exact estimate a irp is cached or not?
4,is set flag in streamhandle context correctly? the flag contine:Should be
decrypt on read,should be encrypt on write,these flags base on encrypt flag
and current process name.
Thanks!