MiniFilter Driver - modify a file bytes on IRP_MJ_CLOSE and IRP_MJ_CREATE

Question

I'd like to change a file when it is closed and reverse the change when it is opened. It's kind of like encryption driver except I don't want to encrypt the file.

I've created a new "Filter Driver: Filesystem Mini-Filter" project with WDK8 in Visual Studio 2012 and registered PreCreate, PostCreate, PreClose and PostClose as callback functions.

For example, on IRP_MJ_CLOSE of file which it's byte are {72,101,108,108,111} ("Hello"), I want that after the PostClose function the file would look like this on the hard disk: {10,11,12,72,101,108,108,111}.

I suspect it is not as easy as just:

    FLT_PREOP_CALLBACK_STATUS
    PreClose (
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
    )
{
    //...

    //some if statment...
    {
        Data->Iopb->Parameters.Write.WriteBuffer = newBfr;
        Data->Iopb->Parameters.Write.Length = newLen;
    }
    //...

    return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

I'd like some guidance on the subject.

Also what is the best way to debug this? I Haven't found a way to print to the windows 7 debug.

Thanks! gfgqtmakia.

EDIT: I've read http://code.msdn.microsoft.com/windowshardware/swapBuffer-File-System-6b7e6e2d but I don't think it'll help me because it is for read/write, which I don't want to deal with.

EDIT2: Or maybe I should do my changes in the PreCreate and PostClose, when the file is on the hard drive and not in the middle of an IRP, and then I won't need to deal with buffers "on the fly" but on the disk?

Answer 1

You will have to write something like swap buffers. Modifying file data in PostCreate/PreClose would not be good idea.

Few reasons:

• Firstly in PostCreate/PreClose you shouldn't be accessing Data->Iopb->Parameters.Write.WriteBuffer. That is valid only in IRP_MJ_WRITE. You can do FltWriteFile to write data to file.
• Windows kernel may not write file data immediately to the disk in/after IRP_MJ_CLOSE. Think about page cache.
• There are may complexities like paging i/o, direct i/o etc. that need to be taken care properly.
• Another major thing I notice it that you will also change the file size (as said in your question actual data length is 5 bytes while you will update data to 8 bytes). Now this is very difficult to manage. It never recommended to change the file size in minifilter/file system driver.