Problem: Changing extension in PreCreate

NTFSD
1

Hi all, I’m new in minifilter.
If anyone could give me some advice, I would be very grateful.

The problem is:
I changed the file extension in preCreate (e.g., from “abc.txt” to “abc.txt.encrypt”, then set callbackdata dirty). but in postCreate, every time I received an error status as “STATUS_OBJECT_PATH_NOT_FOUND” . Therefore, I failed to create the file.

I also set “FltObjects->FileObject->RelatedFileObject = NULL;”

I think there must be something wrong. Could anyone please give me some advice? Many thanks.

2

status = IoReplaceFileObjectName(Data->Iopb->TargetFileObject, newName.Buffer, newName.Length);

where “newName” is a full name, containing volume name, parentDir and final component.

Thanks!

3

Please check the flags with which you are calling CreateFile. Are they
trying to open an existing file or trying to create a new file?

On Mon, Jul 17, 2017 at 11:38 PM, xxxxx@gmail.com <
xxxxx@lists.osr.com> wrote:

status = IoReplaceFileObjectName(Data->Iopb->TargetFileObject,
newName.Buffer, newName.Length);

where “newName” is a full name, containing volume name, parentDir and
final component.

Thanks!

NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

4

Thanks dhananjay.

Sorry I didn’t provide more information. It was “FILE_CREATE”, trying to create a new file.

What I want to do are:

  1. when opening or creating a file (e.g., abc.txt), if the file exists, do nothing.
  2. if the file does not exists, try opening/creating its corresponding encrypted version: i.e. abc.txt.encrypt.

I think maybe something is wrong with the “desktop.ini” file. When create a new file, I add an extra extension “.encrypt” to it. But now I have NOT finish the QueryInformation, DirectoryControl IRPs to hide the extension.

I’m going to do more test to fix the issue.
Thank you.

5

Hi all.
Finally, I fixed the problem.

The point is that in PreCreate the FileObject->FileName does NOT contain the volume name.
(like: \Users\WDKRemoteUser\Testing\ab.txt)
I got the new name by FltGetFileNameInformation routine which returned a full path containing volume Name.
(like: \Device\HarddiskVolume2\Users\WDKRemoteUser\Testing\ab.txt)

When I replaced it with IoReplaceFileObjectName, in the postCreate callback, it always returned a “STATUS_OBJECT_PATH_NOT_FOUND” status.

I hope this can help beginners.