感觉你的错误有一些，比如
NTSTATUS
SfRead(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
PSFILTER_DEVICE_EXTENSION DevExt = (PSFILTER_DEVICE_EXTENSION) DeviceObject->DeviceExtension;
PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
PFILE_OBJECT FileObject = IrpSp->FileObject;
PREAD_WRITE_COMPLETION_CONTEXT CompletionCtx = NULL;
PVOID OldBuffer = NULL;
PVOID MyBuffer = NULL;
ULONG Length = 0;
FILE_CONTEXT FileCtx;
PFILE_CONTEXT FileCtxPtr = NULL;
NTSTATUS Status = STATUS_SUCCESS;

PAGED_CODE();

//
// Sfilter doesn\'t allow handles to its control device object to be created,
// therefore, no other operation should be able to come through.
//  
ASSERT(!IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject));
ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject));

//
// We only care about volume filter device object
//
if (!DevExt->StorageStackDeviceObject)
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(DevExt->AttachedToDeviceObject, Irp);
}

#if DBG
if (DevExt->DriveLetter != DEBUG_VOLUME)
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(DevExt->AttachedToDeviceObject, Irp);
}
#endif

if (!(Irp->Flags & (IRP_NOCACHE | IRP_PAGING_IO | IRP_SYNCHRONOUS_PAGING_IO)))
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(DevExt->AttachedToDeviceObject, Irp);
}

ExAcquireFastMutex(&DevExt->FsCtxTableMutex);

FileCtx.FsContext = FileObject->FsContext;
FileCtxPtr = RtlLookupElementGenericTable(&DevExt->FsCtxTable, &FileCtx);

ExReleaseFastMutex(&DevExt->FsCtxTableMutex);

if (!FileCtxPtr || !FileCtxPtr->DecryptOnRead)
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(DevExt->AttachedToDeviceObject, Irp);
}

do
{
if (Irp->MdlAddress)
OldBuffer = MmGetSystemAddressForMdl(Irp->MdlAddress);
else
OldBuffer = Irp->UserBuffer;

if (!OldBuffer)
{
KdPrint((\"sfilter!SfRead: STATUS_INVALID_PARAMETER\\n\"));
Status = STATUS_INVALID_PARAMETER;
break;
}

Length = IrpSp->Parameters.Write.Length;

CompletionCtx = ExAllocateFromNPagedLookasideList(&gReadWriteCompletionCtxLookAsideList);
if (!CompletionCtx)
{
KdPrint((\"sfilter!SfRead: STATUS_INSUFFICIENT_RESOURCES\\n\"));
Status = STATUS_INSUFFICIENT_RESOURCES;
break;
}

MyBuffer = ExAllocatePoolWithTag(NonPagedPool, IrpSp->Parameters.Write.Length,
//错误，改为IrpSp->Parameters.Read.Length，相视问题同样处理

SFLT_POOL_TAG);
if (!MyBuffer)
{
KdPrint((\"sfilter!SfRead: STATUS_INSUFFICIENT_RESOURCES\\n\"));
ExFreePool(CompletionCtx);
Status = STATUS_INSUFFICIENT_RESOURCES;
break;
}

CompletionCtx->OldMdl = Irp->MdlAddress;
CompletionCtx->OldUserBuffer = Irp->UserBuffer;
CompletionCtx->OldSystemBuffer = Irp->AssociatedIrp.SystemBuffer;

CompletionCtx->OldBuffer = OldBuffer;
CompletionCtx->MyBuffer = MyBuffer;
CompletionCtx->Length = Length;

Irp->MdlAddress = IoAllocateMdl(MyBuffer, IrpSp->Parameters.Write.Length, FALSE, TRUE, NULL);
if (!Irp->MdlAddress)
{
KdPrint((\"sfilter!SfRead: STATUS_INSUFFICIENT_RESOURCES\\n\"));
Irp->MdlAddress = CompletionCtx->OldMdl;
ExFreePool(CompletionCtx);
ExFreePool(MyBuffer);
Status = STATUS_INSUFFICIENT_RESOURCES;
break;
}

KdPrint((\"sfilter!SfRead: Decrypt %ws\\n\", FileCtxPtr->Name));

MmBuildMdlForNonPagedPool(Irp->MdlAddress);
Irp->UserBuffer = MmGetMdlVirtualAddress(Irp->MdlAddress);

IoCopyCurrentIrpStackLocationToNext(Irp);
IoSetCompletionRoutine(Irp, SfReadCompletion, CompletionCtx, TRUE, TRUE,TRUE);
return IoCallDriver(DevExt->AttachedToDeviceObject, Irp);
} while (FALSE);

Irp->IoStatus.Status = Status;
IoCompleteRequest(Irp, IO_NO_INCREMENT);

return Status;
}
2 解密你考虑太多了，没有用，浪费资源。
3 你为何不能加密根目录，是因为你的代码加密判定不完善，所以修改了根目录区。

4 文件名获取参考filemon，很好的例子
5 不需要加ExReleaseFastMutex，这个影响你的性能。
以上我的个人看法，不一定对。