/// <summary>
/// Add the new filter rule to the filter driver.
/// </summary>
/// <param name="accessFlag">access control rights of the file IO to the files which match the filter mask</param>
/// <param name="filterMask">the filter rule file filter mask, it must be unique.</param>
/// <param name="isResident">if it is true, the filter rule will be added to the registry, get protection in boot time.</param>
/// <param name="filterRuleId">the id to identify the filter rule, it will show up in messageId field of messageSend structure if the callback is registered</param>
/// <returns></returns>
[DllImport("FilterAPI.dll", SetLastError = true)]
public static extern bool AddFileFilterRule(
uint accessFlag,
[MarshalAs(UnmanagedType.LPWStr)]string filterMask,
bool isResident,
uint filterRuleId );

 //the code snippet to encrypt the file with the file filter rule.

 FilterControl filterControl = new FilterControl();
 FilterAPI.FilterType filterType = FilterAPI.FilterType.CONTROL_FILTER | FilterAPI.FilterType.ENCRYPTION_FILTER | FilterAPI.FilterType.PROCESS_FILTER;
 int filterConnectionThreads = 5;
 int connectionTimeOut = 30;
 string licenseKey = "your license key";
 string lastError = string.Empty;
 filterControl.StartFilter(filterType,filterConnectionThreads, GlobalConfig.ConnectionTimeOut, licenseKey, ref lastError);

 //setup a file filter rule for folder encryptFolder
 FileFilter fileFilter = new FileFilter("c:\\encryptionFolder\\*");
                
 //enable the encryption for the filter rule.
 fileFilter.EnableEncryption = true;
                           
 //setup the 256bits encryption key,put your own encryption key here
 byte[] encryptionKey =  {0x60,0x3d,0xeb,0x10,0x15,0xca,0x71,0xbe,0x2b,0x73,0xae,0xf0,0x85,0x7d,0x77,0x81,0x1f,0x35,0x2c,0x07,0x3b,0x61,0x08,0xd7,0x2d,0x98,0x10,0xa3,0x09,0x14,0xdf,0xf4};
 fileFilter.EncryptionKey = encryptionKey;

 //add the encryption file filter rule to the filter control
 filterControl.AddFilter(fileFilter);
                        

//enable the encryption key from service, you can append the custom DRM data
fileFilter.EnableEncryptionKeyFromService = true;
//in the callback function OnFilterRequestEncryptKey, you can authorize the file access in the callback function
fileFilter.OnFilterRequestEncryptKey += OnFilterRequestEncryptKey;
  
public void OnFilterRequestEncryptKey(object sender, EncryptEventArgs e)
{
    e.ReturnStatus = NtStatus.Status.Success;

    if (e.IsNewCreatedFile)
    {
        //if you want to block the new file creation, you can return accessdenied status.
        //e.ReturnStatus = NtStatus.Status.AccessDenied;

        //if you want to the file being created without encryption, return below status.
        //e.ReturnStatus = NtStatus.Status.FileIsNoEncrypted;

        //for the new created file, you can add your custom tag data to the header of the encyrpted file.
        //here we just add the file name as the tag data.
        e.EncryptionTag = UnicodeEncoding.Unicode.GetBytes(e.FileName);
    }
    else
    {
        //this is the encrytped file open request, request the encryption key and iv.

        //if you want to block encrypted file being opened, you can return accessdenied status.
        //e.ReturnStatus = NtStatus.Status.AccessDenied;

        //if you want to return the raws encrypted data for this encrypted file, return below status.
        //e.ReturnStatus = NtStatus.Status.FileIsEncrypted;

        //here is the tag data if you set custom tag data when the new created file requested the key.
        byte[] tagData = e.EncryptionTag;
    }

    //here is the encryption key for the encrypted file, you can set it with your own key.
    e.EncryptionKey = Utils.GetKeyByPassPhrase(GlobalConfig.MasterPassword, 32);
           
    //if you want to use your own iv for the encrypted file, set the value here, 
    //or don't set the iv here, then the unique auto generated iv will be assigned to the file.
    //e.IV = Utils.GetIVByPassPhrase(GlobalConfig.MasterPassword);

}

typedef enum _AESFlags
{
    Flags_Enabled_Expire_Time			=	0x00000010, 
    Flags_Enabled_Check_ProcessName		=	0x00000020, 
    Flags_Enabled_Check_UserName		=	0x00000040, 
    Flags_Enabled_Check_AccessFlags		=	0x00000080, 
    Flags_Enabled_Check_User_Permit		=	0x00000100, 
    Flags_AES_Key_Was_Embedded			=	0x00000200, 
    Flags_Request_AccessFlags_From_User	=	0x00000400, 
    Flags_Request_IV_And_Key_From_User	=	0x00000800, 
    Flags_Enabled_Check_Computer_Id		=	0x00001000, 
    Flags_Enabled_Check_User_Password	=	0x00002000, 

}AESFlags;

typedef struct _AES_TAG_CONTROL_DATA 
{
    ULONG		VerificationKey;
    ULONG		AESFlags;
    LONGLONG    CreationTime;
    LONGLONG    ExpireTime;
    ULONG		AccessFlags;
    ULONG		LengthOfIncludeProcessNames;
    ULONG		OffsetOfIncludeProcessNames;
    ULONG		LengthOfExcludeProcessNames;
    ULONG		OffsetOfExcludeProcessNames;
    ULONG		LengthOfIncludeUserNames;
    ULONG		OffsetOfIncludeUserNames;
    ULONG		LengthOfExcludeUserNames;
    ULONG		OffsetOfExcludeUserNames;
    ULONG		LengthOfAccountName;
    ULONG		OffsetOfAccountName;
    ULONG		LengthOfComputerId;
    ULONG		OffsetOfComputerId;
    ULONG		LengthOfUserPassword;
    ULONG		OffsetOfUserPassword;

    //the data store here.
    //IncludeProcessNames;
    //ExcludeProcessNames;
    //IncludeUserNames;
    //ExcludeUserNames;
    //AccountNames;
    //ComputerId;
    //UserPassword;
    
} AES_TAG_CONTROL_DATA, *PAES_TAG_CONTROL_DATA;