Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Writing WDF Drivers | 7 Dec 2020 | LIVE ONLINE |
Internals & Software Drivers | 25 Jan 2021 | LIVE ONLINE |
Developing Minifilters | 8 March 2021 | LIVE ONLINE |
Comments
Ouch.... so in this particular case, not only does FGDFNI fail with INV_PARAM, but whatever I try to do myself fails the same..
IoCreateFileEx(IO_OPEN_TARGET_DIRECTORY).. opens the target directory. ALL other file open APIs fail with STATUS_INVALID_PARAMETER! (IoCreateFile/FltCreateFileEx - Nt/ZwCreateFile don't have a way to open the target folder, or I am missing something)
Then I try to query the file name. NtQueryInformationFIle would fail with ACC_VIOLATION because I am passing a kernel buffer of course.
ZwQueryInformationFile fails with STATUS_INVALID_PARAMETER, regardless of whether I ask for a FileNormalizedNameInformation or FileNameInformation..
There seems to be no way of getting the file name in this situation!
Any ideas?
Funny.. as soon as I wrote the message, after struggling two days to figure a combination that works... solved by opening the directory directly and querying the file name.
Strange, this is a rare case where the issue occurs on Server 2016/Win10, but not on earlier versions!
Note: It is not possible to query Normalized file name, it fails with STATUS_INVALID_PARAMETER. Only FileNameInformation can be queried.