minifilter driver | tracking changes in files - windows-kernel

What I'm trying to achieve is to intercept every write to a file and track the changes within the file. I want to track how much different the file content before and after the write.
So far in my minifilter driver I registered to IRP_MJ_WRITE callbacks and can now intercept writes to file. However I'm still not sure how can I obtain the content of the file before [preoperation] and the content after [postoperation].
The parameters that I have within the callback functions are:
PCFLT_RELATED_OBJECTS, PFLT_CALLBACK_DATA and I could not find anything related to the content of the file itself within these.

These are the operations that could change data in a file:
Modifying the file: IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION ( specifically the FileEndOfFileInformation and FileValidDataLengthInformation information classes), IRP_MJ_FILE_SYSTEM_CONTROL ( specifically FSCTL_OFFLOAD_WRITE, FSCTL_WRITE_RAW_ENCRYPTED and FSCTL_SET_ZERO_DATA fsctl codes).
As for the content of the file itself that you just need to read it yourself.
If you mean the buffers as they are being written for example, check this out to find out more about the parameters of IRP_MJ_WRITE in the callback data. Esentially the buffer is at Data->Iopb->Parameters.Write.WriteBuffer/MdlAddress
Make sure you handle that memory correctly otherwise it will result a BSODs.
Good luck.

Related

keep/copy XMP with libexif

I try to add a thumbnail to a JPEG picture using libexif.
For now I'm borrowing the code from exif (the command line tool that is shipped by the libexif team).
However I noticed the XMP tags get deleted from the metadata. There is an old bugreport here.
I tried to see how to achieve this anyway with libexif but I don't really understand how to get the XMP from input file and put it in the output file. I just want to copy all XMP data, I don't need to extract anything of it.
I saw there is a TAG EXIF_TAG_XML_PACKET in exif_tag.h but couldn't figure out how to read/write this tag.
A related solution is in this SO answer but it looks complicated. I'm not familiar coding in C.
Is it actually possible to keep all XMP when using only libexif API? Have things changed in recent years on that? How would you write this in code?
Thanks
I believe it should be somewhat straightforward. XMP fields are described in the ISO/Adobe standard. Regular Kotlin/Java/Android file I/O and some string manipulation should be all that is required.
I would start out by becoming intimately familiar with ISO 16684-1:2019. Then, write a method for your jpeg file class that grabs all the XMP fields. Store those fields in a temp file (to prevent difficult to recover data loss in the event of your code or libexif crashing). Hand the file off to libexif. Generate the thumbnail. Finally, when that's done you can restore the XMP fields. If the thumbnail is stored in an XMP field as well (and it sounds like it is), it may be easier to concatenate that field with the other ones which were already grabbed, updating the temp file so that it contains EVERY XMP field, before adding all of the XMP fields back to the jpeg.
Unfortunately, I do not currently have the time to read a 50 page ISO standard, synthesize the information, and then write the code to implement the solution. Here's a link to the standard at least, to get you started.
https://www.iso.org/obp/ui/#iso:std:iso:16684:-1:ed-2:v1:en

How to start Microsoft Word from Java FX with parameters to run a macro

I have a document management system which stores files in a MS Word format. In my application, I would like to be able to open that document in Word.
I would like Word to handle all of the file system access out of the content management system. What I need to do is the following:
1) Create a new document based off a template, and then provide information that can be parsed and placed into specific fields.
I see I can do this as follows:
Runtime.getRuntime().exec("C:/Program Files (x86)/Microsoft Office/Office15/winword.exe /ttemplate_name");
My assumption here is that the template is installed on the local drive. However I would like to provide some data so that fields could be prepopulated and I am not sure how to do that?
2) I would like to be able to run a macro to open the document directly from the content management system. I think I can run a macro as follows:
Runtime.getRuntime().exec("C:/Program Files (x86)/Microsoft Office/Office15/winword.exe /mmacro_name");
However, in this case, I would need to provide the document id from the content management system so that it can retrieve it and open it.
I am unsure what switch or parameter I can use to provide the additional data for word?
Thanks!
Word provides no command-line facility to pass arguments or data when opening or creating a document.
As long as macro code is available, the macro can read data that's stored somewhere, such as in an XML file. But the file path would need to be hard-coded or derivable from a known location (path).
You don't necessarily need to call a macro in a document (or template attached to the document). If the macro is named AutoNew or AutoOpen it will execute automatically when a document is created from the template or, respectively, when a document is opened.

Problems with GitHub rendering my README.rst incorrectly..?

I've got a GitHub repo/branch where I'm attempting to update the README.rst, but it's not formatting the way I expect when it comes to the bullet lists I'm including.
Everything seems ok except for my Usage section, in which I have the following:
*****
Usage
*****
- Open the template file that corresponds to the API call you'd like to make.
* Example: If we want to make a call to the RefundTransaction API we open up /templates/RefundTransaction.php
- You may leave the file here, or save this file to the location on your web server where you'd like this call to be made.
* I like to save the files to a separate location and keep the ones included with the library as empty templates.
* Note that you can also copy/paste the template code into your own file(s).
- Each template file includes PHP arrays for every parameter available to that particular API. Simply fill in the array parameters with your own dynamic (or static) data. This data may come from:
* Session Variables
* General Variables
* Database Recordsets
* Static Values
* Etc.
- When you run the file you will get a $PayPalResult array that consists of all the response parameters from PayPal, original request parameters sent to PayPal, and raw request/response info for troubleshooting.
* You may refer to the `PayPal API Reference Guide <https://developer.paypal.com/webapps/developer/docs/classic/api/>`_ for details about what response parameters you can expect to get back from any successful API request.
+ Example: When working with RefundTransaction, I can see that PayPal will return a REFUNDTRANSACTIONID, FEEREFUNDAMT, etc. As such, I know that those values will be included in $PayPalResult['REFUNDTRANSACTIONID'] and $PayPalResult['FEEREFUNDAMT'] respectively.
- If errors occur they will be available in $PayPalResult['ERRORS']
You may refer to this `overview video <http://www.angelleye.com/overview-of-php-class-library-for-paypal/>`_ of how to use the library,
and there are also samples provided in the /samples directory as well as blank templates ready to use under /templates.
You may `contact me directly <http://www.angelleye.com/contact-us/>`_ if you need additional help getting started. I offer 30 min of free training for using this library,
which is generally plenty to get you up-and-running.
For some reason, though, when you look at that on GitHub the first line of the bullet lists is coming up bold and italics and I have no idea why. Also, the sub-list where it shows Session Variables, General Variables, etc. is supposed to be all the same sub-list. I'm not sure why it's dropping into another sub when it sees General Variables.
Any information on what I've done wrong here would be greatly appreciated. Thanks!
Switch from .rst to .md and then use '#' for your headings.
## Usage
- Open the template file that corresponds to the API call you'd like to make.
* Example

LibXML: Comment-out a block of Elements

IS there a way to add/initate a comment ( e.g. $dom->createComment ... ) such that it comments out an entire block of xml tags. Basically I want to turn-off the content between the comment.
For example, it would look like this:
<TT>
<AA>keep</AA>
<!-- comment to blocking
<BB>hideme1</BB>
<CC>hideme2</CC>
-->
<DD>d's content is good</DD>
</TT>
Actually this question is a pre-cursor to my attempt to figure-out a method to be able to markup/label/identify the changes to an xml files in support of new client software functionality, but be able to have the ability to remove / back-out these xml changes in the rare event the client needs to fall back to the previous software version (and no I can't just simply point back to the original xml file because the client is allowed to make minor modifications to existing node text values). This is all going to be controlled via a perl script and LibXML's core modules (I can't use modules the client doesn't have).
So basically I've identified three possible types of xml changes as a result of new client sw functionality:
1.) ADD new element node(s) (typically to support new sw functionality)
2.) DELETE element node(s), or blocks of (would be rare, but never-the-less a possibility)
3.) CHANGE node text values (rare, but the new sw may require a new value)
For all three types, the client needs the ability to back out the changes. One thing I was thinking to use is ATTRIBUTES since the existing xml files don't use them. For example, for an ADD change type, I could include an atribute like 'ADD="sw version 4.1"' . This way if it needs to be removed, I could just simply have the perl script find those attribute strings and delete them (using LibXML methods). Same thing with CHANGE change type - I could use an attribute like CHG="newvalue_oldvalue", then again use straight perl (or LibXML) to switch back the value based on the contents of the attribute. The DELETE change type is giving me a problem though (as welll as the others lol!). I want to be able to "keep" the deleted lines in the xml file soley for the purposes if the sw falls back a version (at some late point the perl script could eventually cleanup/delete them).
I know this is a lot, I'm new to LibXML (but not to perl). I was just wonder if any of you have any thoughts as to how to go about it or seen anything resembling this kind of request ... I'd be grateful for any kind of advice! Thank you...

How do I append text to an existing XML file without rewriting the entire document?

I have a large amount of data in an XML file, and I'd like to append data to this file without rewriting it every time. I already know how to write the entire file out, but I'm struggling with how to append data to this file. Do you have a suggestion for how to do this?
XML isn't a good format for this - if you append to a previously-complete document, it's no longer a complete document.
One option (depending on the APIs available to you) is not to write the root tag or document declaration, but to fake them when you read the file. So you'd have:
Fake document declaration
Fake root open tag
Real data from the file
Fake root close tag
Then you can just append elements to the end of your file at will. It will depend on what you're trying to do with this file though - and whether you can fake a stream input which effectively "tops and tails" the real data in the file.