I know this subject has popped up several times, but the archives don’t
offer a definitive answer.
For IRP_MJ_CREATE requests that I intercept, sometimes I encounter DOS 8.3
formated names. I would like to fetch the full pathname, so I open the file by
passing the DOS name to ZwCreate. Then I call either ZwQueryInformationFile,
or IoQueryFileInformation asking for FileNameInformation. However in both
cases the result returned is the DOS name.
Is there a known method of fetching the name *before* IRP_MJ_CREATE
completes? Or will I have to disable 8.3 name creation (MSDN article Q121007)?