Enterprise File-Encryption Minifilter Driver

Enterprise File-Encryption Minifilter Driver — LANCrypt (Windows)

Maintained & hardened a production‐grade kernel driver that transparently encrypts every file touch-point for Fortune 500 and government clients.

Date: Jul 2019 – Aug 2021
Roles: C/C++ System Programmer · Windows Kernel Developer
Team size: 3
Customer: Multiple Enterprise & Government Clients (banks, airlines, military)
Core Stack:
Kernel-mode: C++17 · Windows Filter Manager (minifilter) · Win32 API
User-tools: WinDbg · Crash-dump analysis · MFC GUI
DevOps: Visual Studio · Git · Jenkins CI/CD

Show more ↓

1. Problem

Customers needed “encrypt-everything” protection on Windows endpoints. Legacy code left executables unguarded against live tampering, and support teams were drowning in driver-related crash dumps.

2. Solution Overview

I evolved the product into a hardened, self-protecting encryption platform:

Component	Purpose	Key Tech
Minifilter	Hooks all file create / read / write / move events	FltMgr · C++17
Crypto Engine	AES-256 encrypt/decrypt on-the-fly	Windows CNG
Self-Protection	Blocks debugger attach & runtime patching of LANCrypt executables	`ObRegisterCallbacks` API
Diagnostics	Auto-captures & symbols crash dumps for support	WinDbg · KD extension scripts

How it works: Files are encrypted at rest. When they leave the machine (e-mail, copy, upload) the driver decrypts them transparently, ensuring usability without sacrificing security.

3. Impact

Deployed on >100 000 endpoints across finance, aviation and defense sectors
0 successful runtime-tampering incidents since hardening release
Passed an independent black-box security audit three weeks after my self-protection feature shipped
Cut average crash-dump resolution time -60 % via symbolized dumps & root-cause automation

4. My Contributions

Re-architected critical driver sections; implemented self-protection via ObRegisterCallbacks; refactored legacy C into modern C++17; analysed >50 customer crash dumps down to assembly level; mentored junior devs in Windows internals.

5. Key Challenges & Mitigations

Challenge	Mitigation & Result
Executables could be debugged & patched live	Added kernel-level object callbacks → blocked tampering, audit passed
Legacy, brittle C codebase	Incremental C++17 refactor + unit tests → 20 % fewer regression bugs
Difficult crash-dump triage	Custom WinDbg scripts + symbol server → diagnostics < 15 min per case