Files Redirection Problem

Hi everyone.

I want to change files’ extension, for example from “abc.txt” to “abc.txt.encrypt”. I got normalized full name of the file in preCreate callback, and then changed the filename by IoReplaceFileObjectName routine, then :
FltObjects->FileObject->RelatedFileObject = NULL;
FltSetCallbackDataDirty(Data);
retValue = FLT_PREOP_SUCCESS_WITH_CALLBACK;
I think the code was right. But in postCreate callback, every time the received an error status “STATUS_OBJECT_PATH_NOT_FOUND”.

So I failed to create the file.
I don’t know where is wrong. Thanks for any advice.

Hi all.
Finally, I fixed the problem.

The point is that in PreCreate the FileObject->FileName does NOT contain the
volume name.
(like: \Users\WDKRemoteUser\Testing\ab.txt)
I got the new name by FltGetFileNameInformation routine which returned a full
path containing volume Name.
(like: \Device\HarddiskVolume2\Users\WDKRemoteUser\Testing\ab.txt)

When I replaced it with IoReplaceFileObjectName, in the postCreate callback, it
always returned a “STATUS_OBJECT_PATH_NOT_FOUND” status.

I hope this can help beginners.

fileObject->FileName should NOT contain volume name. Is this correct?

> fileObject->FileName should NOT contain volume name. Is this correct?

Correct. The ONLY time that that field is valid is in the pre-create
path. As a matter of courtesy some file systems fill it in with the
momentarily correct name, but it is nothing more than convenience. Remember
too that it can be null, and can just contain a stream name. Also beware
that the semantics around relative names and streams changed subtly sometime
between XP and Win8 (you used to be able to open “:foo” relative to
“foo:bar”, but now you cannot.

I got the new name by FltGetFileNameInformation

You are aware of the performance issue involved in calling this in the pre
path. Also note that of a related file or directory may change between you
querying the name and the file being opened so you could end up opening the
wrong name.

Thanks Rod. I really appreciate your reply.

Are there any better ways to get full file name rather than using FltGetFileNameInformation?
Thanks.