Word 2003 Save Failed When BaseAddress returned by ZwMapViewOfSection is replaced

NTFSD
1

Hello,
I use SSDT HOOK to encrypt/decrypt files and add header in those files.
I add header in ZwCreateFile and change the offset in ZwReadFile and ZwWriteFile. Then it comes to the section. In ZwCreateSection I add my header size to the section size. In ZwMapViewOfSection I allocate a new buffer in the user space and copy decpyted data to it then return the new buffer address. And in ZwUnmapViewOfSection I copy the data back to the original baseaddress. It works fine with notepad, office 2007 etc.
But in word 2003, when I create a new doc file and save, it always says that ‘The save failed due to out of memory or disk space’.
Does anyone know what the winword.exe does when saved? Or Does anyone have a better idea to deal with the section?

2

Use a filesystem filter. Hooking the system service table to accomplish this is unsupported and won’t give you the results you’re looking for.

  • S

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of luyunyan_xm@163.com
Sent: Monday, September 06, 2010 6:35 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Word 2003 Save Failed When BaseAddress returned by ZwMapViewOfSection is replaced

Hello,
I use SSDT HOOK to encrypt/decrypt files and add header in those files.
I add header in ZwCreateFile and change the offset in ZwReadFile and ZwWriteFile. Then it comes to the section. In ZwCreateSection I add my header size to the section size. In ZwMapViewOfSection I allocate a new buffer in the user space and copy decpyted data to it then return the new buffer address. And in ZwUnmapViewOfSection I copy the data back to the original baseaddress. It works fine with notepad, office 2007 etc.
But in word 2003, when I create a new doc file and save, it always says that ‘The save failed due to out of memory or disk space’.
Does anyone know what the winword.exe does when saved? Or Does anyone have a better idea to deal with the section?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Skywing,
Thank you for your reply. I have had a filesystem filter already but i also need the SSDT in some special cases.