Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Writing our own FltGetDestinationFileNameInformation?

Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 311
via Email in NTFSD
Has anyone done it?
There are too many cases now, even with the most current MS OS/FS
combinations, that it is a total shame such an API is even out...

E.g. we just found that using symbolic links to a mapped network drive
causes FGDFNI to fail with STATUS_INVALID_PARAMETER... not an atypical
scenario as much as some might think. On the contrary, it is heavily
used in some cloud solutions.

Comments

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 311
    edited April 10

    Ouch.... so in this particular case, not only does FGDFNI fail with INV_PARAM, but whatever I try to do myself fails the same..
    IoCreateFileEx(IO_OPEN_TARGET_DIRECTORY).. opens the target directory. ALL other file open APIs fail with STATUS_INVALID_PARAMETER! (IoCreateFile/FltCreateFileEx - Nt/ZwCreateFile don't have a way to open the target folder, or I am missing something)

    Then I try to query the file name. NtQueryInformationFIle would fail with ACC_VIOLATION because I am passing a kernel buffer of course.
    ZwQueryInformationFile fails with STATUS_INVALID_PARAMETER, regardless of whether I ask for a FileNormalizedNameInformation or FileNameInformation..

    There seems to be no way of getting the file name in this situation!

    Any ideas?

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 311
    edited April 10

    Funny.. as soon as I wrote the message, after struggling two days to figure a combination that works... solved by opening the directory directly and querying the file name.
    Strange, this is a rare case where the issue occurs on Server 2016/Win10, but not on earlier versions!

    Note: It is not possible to query Normalized file name, it fails with STATUS_INVALID_PARAMETER. Only FileNameInformation can be queried.

    Post edited by Dejan_Maksimovic on
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA