Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

FltGetVolumeFromName

Tenti_Gian-LucaTenti_Gian-Luca Member Posts: 37
Hi,



in a IRP_MJ_CREATE's Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call
the FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the
system go on BSOD.

I've the same result even with a code like this



FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)



...

PFLT_VOLUME Volume = NULL;



status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);





The Filter pointer and the Volume's name are correct.



The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from
which the file that I want to open belong.



Thank's

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Since this is pre-Create, the file hasn't been opened yet, so you shouldn't
    use FLT_FILE_NAME_OPENED -- probably should be FLT_FILE_NAME_NORMALIZED.

    Are you calling FltParseFileNameInformation? (You didn't show it.) That is
    needed to set nameInfo->Volume.

    But if you're getting the correct volume name, it's difficult to see what
    the problem is.

    An alternate approach would be to call FltGetVolumeName() to get a list of
    the volume names and match it that way.

    HTH,
    Ken


    ________________________________

    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 9:27 AM
    To: Windows File Systems Devs Interest List
    Subject: [ntfsd] FltGetVolumeFromName



    Hi,



    in a IRP_MJ_CREATE's Pre operation callback, I call the FltCreateFile to
    open a file in another volume.

    To avoid a loop,
    I have to get the Instance of my filter for that volume and so I call the
    FltGetVolumeFromName to obtain the pVolume pointer and then call the
    FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
    on BSOD.

    I've the same result even with a code like this



    FLT_PREOP_CALLBACK_STATUS

    SpyPreOperationCallback (

    IN OUT PFLT_CALLBACK_DATA Data,

    IN PCFLT_RELATED_OBJECTS FltObjects,

    OUT PVOID *CompletionContext

    )



    .

    PFLT_VOLUME Volume = NULL;



    status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
    FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

    status =
    FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);





    The Filter pointer and the Volume's name are correct.



    The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
    ((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
    the file that I want to open belong.



    Thank's


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]
  • Tenti_Gian-LucaTenti_Gian-Luca Member Posts: 37
    Thank's Ken,

    I'm new to minifilter and my example is wrong, what I really want to do is:
    0) starting from a pre create callback to \device\HarddiskVolume1\Test\Pippo.txt
    1) create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
    2) Using FltCreateFile, test the existence of the point's 1 file

    So I need to get the instance and before, the PFLT_VOLUME of \device\HarddiskVolume2

    If I use the FltGetVolumeFromName with the \device\HarddiskVolume2 VolumeName, the system go on BSOD.

    Now I'm writing a cache that hold the VolumeName/Instance values and a function that find the filter instance getting the file full path.
    It seems to work, but I would know where I'm wrong in the first method.

    -----Original Message-----
    From: [email protected] [mailto:[email protected]] On Behalf Of Ken Cross
    Sent: luned? 16 gennaio 2006 15.57
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName


    Since this is pre-Create, the file hasn't been opened yet, so you shouldn't
    use FLT_FILE_NAME_OPENED -- probably should be FLT_FILE_NAME_NORMALIZED.

    Are you calling FltParseFileNameInformation? (You didn't show it.) That is
    needed to set nameInfo->Volume.

    But if you're getting the correct volume name, it's difficult to see what
    the problem is.

    An alternate approach would be to call FltGetVolumeName() to get a list of
    the volume names and match it that way.

    HTH,
    Ken


    ________________________________

    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 9:27 AM
    To: Windows File Systems Devs Interest List
    Subject: [ntfsd] FltGetVolumeFromName



    Hi,



    in a IRP_MJ_CREATE's Pre operation callback, I call the FltCreateFile to
    open a file in another volume.

    To avoid a loop,
    I have to get the Instance of my filter for that volume and so I call the
    FltGetVolumeFromName to obtain the pVolume pointer and then call the
    FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
    on BSOD.

    I've the same result even with a code like this



    FLT_PREOP_CALLBACK_STATUS

    SpyPreOperationCallback (

    IN OUT PFLT_CALLBACK_DATA Data,

    IN PCFLT_RELATED_OBJECTS FltObjects,

    OUT PVOID *CompletionContext

    )



    .

    PFLT_VOLUME Volume = NULL;



    status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
    FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

    status =
    FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);





    The Filter pointer and the Volume's name are correct.



    The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
    ((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
    the file that I want to open belong.



    Thank's


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]



    ---
    Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to [email protected]
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Again, are you calling FltParseFileNameInformation? (You didn't show it.)
    That is needed to set nameInfo->Volume.

    Otherwise, I don't see anything particularly wrong, although I haven't used
    FltGetVolumeFromName.

    Ken

    -----Original Message-----
    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 10:45 AM
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName


    Thank's Ken,

    I'm new to minifilter and my example is wrong, what I really want to do is:
    0) starting from a pre create callback to
    \device\HarddiskVolume1\Test\Pippo.txt
    1) create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
    2) Using FltCreateFile, test the existence of the point's 1 file

    So I need to get the instance and before, the PFLT_VOLUME of
    \device\HarddiskVolume2

    If I use the FltGetVolumeFromName with the \device\HarddiskVolume2
    VolumeName, the system go on BSOD.

    Now I'm writing a cache that hold the VolumeName/Instance values and a
    function that find the filter instance getting the file full path.
    It seems to work, but I would know where I'm wrong in the first method.

    -----Original Message-----
    From: [email protected]
    [mailto:[email protected]] On Behalf Of Ken Cross
    Sent: luned? 16 gennaio 2006 15.57
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName


    Since this is pre-Create, the file hasn't been opened yet, so you shouldn't
    use FLT_FILE_NAME_OPENED -- probably should be FLT_FILE_NAME_NORMALIZED.

    Are you calling FltParseFileNameInformation? (You didn't show it.) That is
    needed to set nameInfo->Volume.

    But if you're getting the correct volume name, it's difficult to see what
    the problem is.

    An alternate approach would be to call FltGetVolumeName() to get a list of
    the volume names and match it that way.

    HTH,
    Ken


    ________________________________

    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 9:27 AM
    To: Windows File Systems Devs Interest List
    Subject: [ntfsd] FltGetVolumeFromName



    Hi,



    in a IRP_MJ_CREATE's Pre operation callback, I call the FltCreateFile to
    open a file in another volume.

    To avoid a loop,
    I have to get the Instance of my filter for that volume and so I call the
    FltGetVolumeFromName to obtain the pVolume pointer and then call the
    FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
    on BSOD.

    I've the same result even with a code like this



    FLT_PREOP_CALLBACK_STATUS

    SpyPreOperationCallback (

    IN OUT PFLT_CALLBACK_DATA Data,

    IN PCFLT_RELATED_OBJECTS FltObjects,

    OUT PVOID *CompletionContext

    )



    .

    PFLT_VOLUME Volume = NULL;



    status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
    FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

    status =
    FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);





    The Filter pointer and the Volume's name are correct.



    The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
    ((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
    the file that I want to open belong.



    Thank's


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]



    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to [email protected]


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]
  • Tenti_Gian-LucaTenti_Gian-Luca Member Posts: 37
    The firt example that is wrong, I used the FltGetFileNameInformation output data only for test, but what I need is to use the FltGetVolumeFromName with a generic string that I create (without the FltGetFileNameInformation).
    But using the FltGetFileNameInformation and with a correct nameInfo->Volume value (tested in debugger) the FltGetVolumeFromName fail with BSOD.
    So how the FltGetVolumeFromName is to be used?
    Suppose that the string containing the volume name is created not by FltGetVolumeFromName, but in some other way.

    Thank's

    -----Original Message-----
    From: [email protected] [mailto:[email protected]] On Behalf Of Ken Cross
    Sent: luned? 16 gennaio 2006 17.28
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName

    Again, are you calling FltParseFileNameInformation? (You didn't show it.)
    That is needed to set nameInfo->Volume.

    Otherwise, I don't see anything particularly wrong, although I haven't used
    FltGetVolumeFromName.

    Ken

    -----Original Message-----
    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 10:45 AM
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName


    Thank's Ken,

    I'm new to minifilter and my example is wrong, what I really want to do is:
    0) starting from a pre create callback to
    \device\HarddiskVolume1\Test\Pippo.txt
    1) create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
    2) Using FltCreateFile, test the existence of the point's 1 file

    So I need to get the instance and before, the PFLT_VOLUME of
    \device\HarddiskVolume2

    If I use the FltGetVolumeFromName with the \device\HarddiskVolume2
    VolumeName, the system go on BSOD.

    Now I'm writing a cache that hold the VolumeName/Instance values and a
    function that find the filter instance getting the file full path.
    It seems to work, but I would know where I'm wrong in the first method.

    -----Original Message-----
    From: [email protected]
    [mailto:[email protected]] On Behalf Of Ken Cross
    Sent: luned? 16 gennaio 2006 15.57
    To: Windows File Systems Devs Interest List
    Subject: RE: [ntfsd] FltGetVolumeFromName


    Since this is pre-Create, the file hasn't been opened yet, so you shouldn't
    use FLT_FILE_NAME_OPENED -- probably should be FLT_FILE_NAME_NORMALIZED.

    Are you calling FltParseFileNameInformation? (You didn't show it.) That is
    needed to set nameInfo->Volume.

    But if you're getting the correct volume name, it's difficult to see what
    the problem is.

    An alternate approach would be to call FltGetVolumeName() to get a list of
    the volume names and match it that way.

    HTH,
    Ken


    ________________________________

    From: [email protected]
    [mailto:[email protected]] On Behalf Of Gian-luca Tenti
    Sent: Monday, January 16, 2006 9:27 AM
    To: Windows File Systems Devs Interest List
    Subject: [ntfsd] FltGetVolumeFromName



    Hi,



    in a IRP_MJ_CREATE's Pre operation callback, I call the FltCreateFile to
    open a file in another volume.

    To avoid a loop,
    I have to get the Instance of my filter for that volume and so I call the
    FltGetVolumeFromName to obtain the pVolume pointer and then call the
    FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
    on BSOD.

    I've the same result even with a code like this



    FLT_PREOP_CALLBACK_STATUS

    SpyPreOperationCallback (

    IN OUT PFLT_CALLBACK_DATA Data,

    IN PCFLT_RELATED_OBJECTS FltObjects,

    OUT PVOID *CompletionContext

    )



    .

    PFLT_VOLUME Volume = NULL;



    status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
    FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

    status =
    FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);





    The Filter pointer and the Volume's name are correct.



    The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
    ((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
    the file that I want to open belong.



    Thank's


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]



    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to [email protected]


    ---
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]



    ---
    Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
    To unsubscribe send a blank email to [email protected]
  • AntoHeraldAntoHerald Member Posts: 11

    Good afternoon,
    I'm developing a filter driver to read all the volume in the system and get the GUID for the same so that I can apply encryption/Decryption for the desired volume. so, first i'm working on getting all the volume int he system using FltGetVolumeName, below is the code for the same.
    --------------------------------- code ---------------------------------------------------
    FLT_PREOP_CALLBACK_STATUS PreFileOperationCallback(__inout PFLT_CALLBACK_DATA Data,
    __in PCFLT_RELATED_OBJECTS FltObjects, __deref_out_opt PVOID* CompletionContext)
    {
    DbgPrint("\n-------Inside ---PreFileOperationCallback--------");
    NTSTATUS status, ntStatus;
    //PFLT_INSTANCE retInstance = NULL;
    PFLT_VOLUME pVolumeList[MAX_VOLUME_CHARS];
    ULONG VolumeListSize = MAX_VOLUME_CHARS;
    ULONG VolumeNameLength, index = 0;
    PULONG NumberVolumesReturned = NULL;
    WCHAR wszNameBuffer[SHORT_NAME_LEN] = { 0 };
    FILTER_VOLUME_INFORMATION_CLASS FilterVolumeStandardInformation;
    FILTER_VOLUME_STANDARD_INFORMATION FltVolumeStdInfo;
    PULONG BufferSizeNeeded;
    SIZE_T bytesRequired;
    ULONG MEMTAG_VOL_GUID = 0;
    PVOLUME_CONTEXT volumeContext = NULL;
    UNICODE_STRING volumeGuidName, VolumeNameString;
    PVOID VolumeNameBuffer = NULL;

    DbgPrint("\n---------Before FltEnumerateVolumes--------");
    ntStatus = FltEnumerateVolumes(fileHandler, pVolumeList, VolumeListSize, &NumberVolumesReturned);   //Get volume information
    if (!NT_SUCCESS(ntStatus)) {
        return ntStatus;
    }
    DbgPrint("\n-------After  FltEnumerateVolumes---------");
    DbgPrint("\nNumberVolumesReturned - %d",NumberVolumesReturned);
    DbgPrint("\n-------------------------------------------");
    for (index = 1; index <= NumberVolumesReturned; index++)
    {
        if (index == NumberVolumesReturned) {
            break; //break from forLoop
        }
        VolumeNameString.Length = MAX_VOLUME_LENGTH;
        VolumeNameString.Buffer = wszNameBuffer;
        VolumeNameString.MaximumLength = SHORT_NAME_LEN * sizeof(WCHAR);
        DbgPrint("\n---------(1) Before FltGetVolumeName --------");
        //  Query the volume name length.
        ntStatus = FltGetVolumeName(pVolumeList[index], NULL, &VolumeNameLength);   
        DbgPrint("\n-------------------------------------------");
        if ((!NT_SUCCESS(ntStatus) && ntStatus != STATUS_BUFFER_TOO_SMALL)) {
            return FLT_PREOP_SUCCESS_NO_CALLBACK;
        }
        //  Allocate a buffer for the name.
        ntStatus = STATUS_SUCCESS;
        VolumeNameLength += (VolumeNameLength + VolumeNameLength); //increase size to allocate more PagePool memory
        VolumeNameString.Length = (ULONG)VolumeNameLength;
        VolumeNameBuffer = ExAllocatePoolWithTag(PagedPool, VolumeNameLength, MEMTAG_VOL_GUID);
    
        if (VolumeNameBuffer == NULL) {
            ntStatus = STATUS_INSUFFICIENT_RESOURCES;
            break;
        }
        RtlInitEmptyUnicodeString(&VolumeNameString, VolumeNameBuffer, (ULONG)VolumeNameLength);
    
        ntStatus = FltGetVolumeName(pVolumeList[index], &VolumeNameString, NULL);   //Get name using volume information & with max pagePool memory
        DbgPrint("\n-------- Buffered FltGetVolumeName ---------");
        DbgPrint("\nVolumeNameString Length - %ld",VolumeNameString.Length);
        DbgPrint("\nVolumeNameString Buffer - %s", (PWCH)VolumeNameString.Buffer);   //Arun Please review this point
        DbgPrint("\nVolumeNameString MaximumLength-%ld",VolumeNameString.MaximumLength);
        DbgPrint("\n------------------------------");
    }//End of Index forLoop
    
    for (index = 0; index < NumberVolumesReturned; index++)
    {
        FltObjectDereference(pVolumeList[index]);
    }
    //return pInstance;   
    return FLT_PREOP_SUCCESS_NO_CALLBACK;
    

    }

    --------------------- The output is -----------------
    VolumeNameString Length - 36
    VolumeNameString Buffer - \

    VolumeNameString MaximumLength- 36

    But the Microsoft documentation for FltGetVolumeName function says,
    //A pointer to a caller-allocated UNICODE_STRING structure that contains the volume's non-persistent device object name (for example, "\Device\HarddiskVolume1")
    Im unable to get the complete "\Device\HarddiskVolume1" information.
    I need help on this.

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,217

    This thread is 13(!) years old...Start a new one if you have a question

    -scott
    OSR

This discussion has been closed.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE