Re: Is my idea can be implement?

There are several phases in booting from a hard drive:

1. First the BIOS will use INT 13h, usually the 0x4n variants with current BIOS to load the MBR into 0000:7C00h. It is then executed.
2. The MBR code will load the partition boot record (PBR) from the active partition and it will be executed at the same address.
3. The PBR code will load the initial OS code and what this is named varies depending upon the OS being loaded.
4. Windows will load all boot start drivers into memory. Hint: this is IMPORTANT!!!
5. Each boot start driver will have its DriverEntry() invoked. Maybe the add device routine will be invoked followed by a start IRP.
6. After all those boot start drivers are up and running the OS will stop using the INT 13h BIOS software interrupts.

In step 5 you need to query the BIOS code (your extension if you have one or code loaded by the MBR if you use that method). The information passed into your boot start driver will be needed to do the encryption from then on. You might consider looking at Seagate's FDE drives that have encryption in the drive's firmware. That does require the BIOS be written to support those drives since no hard drive is accessable until password credentials, used to obtain access to the encryption key, are provided, validated, and presented to the drive.

When doing this type of code regardless of whether it is on-drive, or a PCI device you will find VMWare useful. Also an ICE will be needed or a lot of patience and knowledge about how storage is used in PCs.

"Robin" <digitalhuman@xxxxxxxxxxx> wrote in message news:O$n2Nid9IHA.5668@xxxxxxxxxxxxxxxxxxxxxxx
Hi all,

I want encrypt whole disk by PCI crypto-card, it's not a partition encryption but WHOLE DISK, so the system partition of OS will be encrypted.
To implement this idea, I will:
(1)Drive my PCI crypto-card before the system booting(so called pre-os driver);
(2)Hook my int13 filter to BIOS, which will do the decryption use my PCI crytpo-card;
(3)Implement a PCI driver for NT, which will drive my PCI crypto-card after the system starting up;
(4)Implement a disk filter driver for NT, whill will implement the read and write of disk sectors in secure mode(encryption and decryption);


My problem is: When the system starting up, the driver of disk and PCI crypto-card will be loaded,
(1) If the PCI crypto-card driver will be loaded first, can INT13 filter call the PCI pre-os 'driver' after it is loaded? If not, the gaps is system can't read encrypted sectors any more!
(2) If the disk filter driver will be loaded first, the INT13 filter will be pasted, any read and write of the disk sectors will be processed by the driver, but at this time, the PCI driver not loaded, can I call the "pre-os driver funtion" to do crypto?


Is there any suggestion ?


Thanks and best regards

Robin 04/08

Relevant Pages

  • Re: hibernation file location
    ... If a disk controller driver was copied to system partition (where NTLDR, ... actually makes sense because the hiberfile contains all of the boot driver ...
    (microsoft.public.development.device.drivers)
  • Re: MS Whistler Personal
    ... I changed the BIOS to boot from the CD drive first but that did nothing. ... I have it in there but I had to erase a partition call 'utilities' as it ... to have any audio and in checking the hardware manager there is no driver ... This is true even in the safe mode. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Getting a 2nd hard disk partition to mount in CE 5.0
    ... This sounds like a load order problem, although I've never seen this result (not mounting of 2nd partition). ... Then when the hive is restored and used driver D, C, B, A would load in that order. ... Once you figure out the differences between a clean boot and a hive boot, force that order by defining "Order" values in the relevant driver settings. ... Can you post your "profile" registry settings for the partitions and other relevant registry settings. ...
    (microsoft.public.windowsce.embedded)
  • Re: hibernation file location
    ... If a disk controller driver was copied to system partition (where NTLDR, BOOT.INI, and NTDETECT.COM reside), and renamed as NTBOOTDD.SYS, then NTLDR would be able to read a kernel and drivers from the boot partition on a drive connected to that controller, even if the controller didn't have a BIOS. ... IIRC the NTBOOTDD.SYS driver is only loaded if the the ARC path in the boot.ini file uses the SCSI or SIGNATURE format when specifying the system drive. ... This actually makes sense because the hiberfile contains all of the boot driver stacks and there would be no need to load the NTBOOTDD.SYS driver when resuming from hibernation. ...
    (microsoft.public.development.device.drivers)
  • Re: soundcard SoundBlaster PCI128 or SoundBlaster live1024 problem
    ... > What messages are you getting from boot log and dmesg? ... ACPI tables contain no PCI IRQ routing entries ... RAMDISK driver initialized: 16 RAM disks of 64000K size 1024 blocksize ... USB Universal Host Controller Interface driver v2.2 ...
    (comp.os.linux.hardware)
Loading