Hi,
I want to modify the contents (flip the bits for now) of any file (on
the fly) that contains the name "output2.txt" in the disk. So far, I
cannot get my filter driver to behave consistently because:
- It encrypts the whole file too many times or too little so when I
read it in Notepad.exe I get all the bits flipped.
My procedure to create this encrypted filter driver is derived from
swapBuffers, included with IFS. Basically from my understanding
swapBuffers:
- Pre IRP_MJ_READ:
sets up a new buffer and a new mdl that the IRP_MJ_WRITE uses
- Post IRP_MJ_READ:
gets the new buffer and new mdl from the Pre IRP_MJ_WRITE and resets
the original Buffer or MdlAddress with it
- Pre IRP_MJ_WRITE:
a) Creates a new buffer and mdl
b) gets the original buffer from iopb->Parameters.Write.WriteBuffer or
MmGetSystemAddressForMdlSafe()
c) Copies the originalBuffer to the new buffer
d) sets the write buffer and mdl address to the new buffer and mdl
- Post IRP_MJ_WRITE:
cleanup
My algorithm
I. Decryption
For my encryption driver I modified the Post IRP_MJ_READ to decrypt
"output2.txt" files. Before it resets the original buffer to the new
buffer, i decrypt (flip the bits) on IRP_NOCACHE:
if (FltObjects->FileObject != NULL) {
status = FltGetFileNameInformation( Data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT,
&nameInfo );
if (NT_SUCCESS( status )) {
nameToUse = &nameInfo->Name;
charName = piUnicode2Ascii(nameToUse);
if (charName && strstr(charName, "output2.txt"))
{
if (FlagOn(IRP_NOCACHE,iopb->IrpFlags)) {
DbgPrint("Read(%s):%s", charName, p2pCtx->SwappedBuffer);
Encrypt(p2pCtx->SwappedBuffer, 0, Data->IoStatus.Information,
p2pCtx->SwappedBuffer);
}
}
}
else
{
nameToUse = &(FltObjects->FileObject)->FileName;
charName = piUnicode2Ascii(nameToUse);
if (charName && strstr(charName, "output2.txt"))
{
if (FlagOn(IRP_NOCACHE,iopb->IrpFlags)) {
DbgPrint("Read2(%s):%s", charName, p2pCtx->SwappedBuffer);
ftEncrypt(p2pCtx->SwappedBuffer, 0,
Data->IoStatus.Information, p2pCtx->SwappedBuffer);
}
}
}
if (charName)
PIMFREE(charName);
if (NULL != nameInfo) {
FltReleaseFileNameInformation( nameInfo );
}
}
II. Encryption
In PRE IRP_MJ_WRITE (for all writes with names) I encrypt the new
buffer that the original buffer will be set to.
RtlCopyMemory( newBuf,
origBuf,
writeLen );
//*************** Encrypt newBuf here ******************
if (FltObjects->FileObject != NULL) {
status = FltGetFileNameInformation( Data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT,
&nameInfo );
if (NT_SUCCESS( status )) {
nameToUse = &nameInfo->Name;
charName = piUnicode2Ascii(nameToUse);
if (charName && strstr(charName, "output2.txt"))
{
//if (FlagOn(IRP_NOCACHE,iopb->IrpFlags)) {
DbgPrint("Write%d:%s", writeLen, charName, newBuf);
Encrypt(newBuf, 0, writeLen, newBuf);
//}
}
//else
//{
// DbgPrint("no name with output2.txt");
//}
}
else
{
nameToUse = &(FltObjects->FileObject)->FileName;
charName = piUnicode2Ascii(nameToUse);
if (charName && strstr(charName, "output2.txt"))
{
//if (FlagOn(IRP_NOCACHE,iopb->IrpFlags)) {
DbgPrint("Write2(%s):%s", charName, newBuf);
Encrypt(newBuf, 0, writeLen, newBuf);
//}
}
}
if (NULL != nameInfo) {
FltReleaseFileNameInformation( nameInfo );
}
if (charName)
PIMFREE(charName);
} else
{
DbgPrint("Fileobject is null?");
}
III. Questions
a) What am I doing wrong that it encrypts too often or not too often?
b) When should I encrypt and when should I decrypt?
c) Should I encrypt during FastIO?
Thank you,
Marc
