The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
As stated in the "Filter Driver Development Guide" chapter 11.2, FltGetDestinationFileNameInformation should be used in the pre callback for IRP_MJ_SET_INFORMATION, and FltGetTunneledName should be used in post in order to vaidate that the name retrieved in the pre operation was not affected by name tunneling.
When testing with mapped network drives I noticed that FltGetTunneledName always returns a FLT_FILE_NAME_INFORMATION (the result is not NULL), meaning that the name was affected by name tunneling. The initially retrieved name (in the pre callback) correctly pointed to the new (renamed) path. The name returned by FltGetTunneledName was always the initial path (before the rename)
I also noticed that FltGetDestinationFileNameInformation returns the correct path (after the rename) in the post operation callback. But, as stated in the documentation, FltGetDestinationFileNameInformation should be called in the pre operation callback.
Another approach that I've tried was calling FltGetFileNameInformation in the post opereation callback, but this also returned the original (not renamed) path.
What's interesting is that when testing with UNC paths (not mapped network drives) the problem didn't appear.
So far i've tested on windows 10 RS5 and windows 10 RS6.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|