Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Writing our own FltGetDestinationFileNameInformation?
Dejan_Maksimovic
Member - All Emails Posts: 303
Has anyone done it?
There are too many cases now, even with the most current MS OS/FS
combinations, that it is a total shame such an API is even out...
E.g. we just found that using symbolic links to a mapped network drive
causes FGDFNI to fail with STATUS_INVALID_PARAMETER... not an atypical
scenario as much as some might think. On the contrary, it is heavily
used in some cloud solutions.
There are too many cases now, even with the most current MS OS/FS
combinations, that it is a total shame such an API is even out...
E.g. we just found that using symbolic links to a mapped network drive
causes FGDFNI to fail with STATUS_INVALID_PARAMETER... not an atypical
scenario as much as some might think. On the contrary, it is heavily
used in some cloud solutions.
Howdy, Stranger!
It looks like you're new here. If you want to get involved, click one of these buttons!
Quick Links
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | Kernel Debugging | 30 Mar 2020 | OSR Seminar Space |
| Developing Minifilters | 15 Jun 2020 | LIVE ONLINE |
| Writing WDF Drivers | 22 June 2020 | LIVE ONLINE |
| Internals & Software Drivers | 28 Sept 2020 | Dulles, VA |
Comments
Ouch.... so in this particular case, not only does FGDFNI fail with INV_PARAM, but whatever I try to do myself fails the same..
IoCreateFileEx(IO_OPEN_TARGET_DIRECTORY).. opens the target directory. ALL other file open APIs fail with STATUS_INVALID_PARAMETER! (IoCreateFile/FltCreateFileEx - Nt/ZwCreateFile don't have a way to open the target folder, or I am missing something)
Then I try to query the file name. NtQueryInformationFIle would fail with ACC_VIOLATION because I am passing a kernel buffer of course.
ZwQueryInformationFile fails with STATUS_INVALID_PARAMETER, regardless of whether I ask for a FileNormalizedNameInformation or FileNameInformation..
There seems to be no way of getting the file name in this situation!
Any ideas?
Funny.. as soon as I wrote the message, after struggling two days to figure a combination that works... solved by opening the directory directly and querying the file name.
Strange, this is a rare case where the issue occurs on Server 2016/Win10, but not on earlier versions!
Note: It is not possible to query Normalized file name, it fails with STATUS_INVALID_PARAMETER. Only FileNameInformation can be queried.