FltGetVolumeFromName

Hi,

in a IRP_MJ_CREATE’s Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call
the FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the
system go on BSOD.

I’ve the same result even with a code like this

FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)

PFLT_VOLUME Volume = NULL;

status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);

The Filter pointer and the Volume’s name are correct.

The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from
which the file that I want to open belong.

Thank’s

Since this is pre-Create, the file hasn’t been opened yet, so you shouldn’t
use FLT_FILE_NAME_OPENED – probably should be FLT_FILE_NAME_NORMALIZED.

Are you calling FltParseFileNameInformation? (You didn’t show it.) That is
needed to set nameInfo->Volume.

But if you’re getting the correct volume name, it’s difficult to see what
the problem is.

An alternate approach would be to call FltGetVolumeName() to get a list of
the volume names and match it that way.

HTH,
Ken


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 9:27 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetVolumeFromName

Hi,

in a IRP_MJ_CREATE’s Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call the
FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
on BSOD.

I’ve the same result even with a code like this

FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)

.

PFLT_VOLUME Volume = NULL;

status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);

The Filter pointer and the Volume’s name are correct.

The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
the file that I want to open belong.

Thank’s


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thank’s Ken,

I’m new to minifilter and my example is wrong, what I really want to do is:
0) starting from a pre create callback to \device\HarddiskVolume1\Test\Pippo.txt

  1. create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
  2. Using FltCreateFile, test the existence of the point’s 1 file

So I need to get the instance and before, the PFLT_VOLUME of \device\HarddiskVolume2

If I use the FltGetVolumeFromName with the \device\HarddiskVolume2 VolumeName, the system go on BSOD.

Now I’m writing a cache that hold the VolumeName/Instance values and a function that find the filter instance getting the file full path.
It seems to work, but I would know where I’m wrong in the first method.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: luned? 16 gennaio 2006 15.57
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Since this is pre-Create, the file hasn’t been opened yet, so you shouldn’t
use FLT_FILE_NAME_OPENED – probably should be FLT_FILE_NAME_NORMALIZED.

Are you calling FltParseFileNameInformation? (You didn’t show it.) That is
needed to set nameInfo->Volume.

But if you’re getting the correct volume name, it’s difficult to see what
the problem is.

An alternate approach would be to call FltGetVolumeName() to get a list of
the volume names and match it that way.

HTH,
Ken


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 9:27 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetVolumeFromName

Hi,

in a IRP_MJ_CREATE’s Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call the
FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
on BSOD.

I’ve the same result even with a code like this

FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)

.

PFLT_VOLUME Volume = NULL;

status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);

The Filter pointer and the Volume’s name are correct.

The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
the file that I want to open belong.

Thank’s


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@ibsnetwork.it
To unsubscribe send a blank email to xxxxx@lists.osr.com

Again, are you calling FltParseFileNameInformation? (You didn’t show it.)
That is needed to set nameInfo->Volume.

Otherwise, I don’t see anything particularly wrong, although I haven’t used
FltGetVolumeFromName.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 10:45 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Thank’s Ken,

I’m new to minifilter and my example is wrong, what I really want to do is:
0) starting from a pre create callback to
\device\HarddiskVolume1\Test\Pippo.txt

  1. create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
  2. Using FltCreateFile, test the existence of the point’s 1 file

So I need to get the instance and before, the PFLT_VOLUME of
\device\HarddiskVolume2

If I use the FltGetVolumeFromName with the \device\HarddiskVolume2
VolumeName, the system go on BSOD.

Now I’m writing a cache that hold the VolumeName/Instance values and a
function that find the filter instance getting the file full path.
It seems to work, but I would know where I’m wrong in the first method.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: luned? 16 gennaio 2006 15.57
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Since this is pre-Create, the file hasn’t been opened yet, so you shouldn’t
use FLT_FILE_NAME_OPENED – probably should be FLT_FILE_NAME_NORMALIZED.

Are you calling FltParseFileNameInformation? (You didn’t show it.) That is
needed to set nameInfo->Volume.

But if you’re getting the correct volume name, it’s difficult to see what
the problem is.

An alternate approach would be to call FltGetVolumeName() to get a list of
the volume names and match it that way.

HTH,
Ken


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 9:27 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetVolumeFromName

Hi,

in a IRP_MJ_CREATE’s Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call the
FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
on BSOD.

I’ve the same result even with a code like this

FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)

.

PFLT_VOLUME Volume = NULL;

status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);

The Filter pointer and the Volume’s name are correct.

The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
the file that I want to open belong.

Thank’s


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@ibsnetwork.it
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

The firt example that is wrong, I used the FltGetFileNameInformation output data only for test, but what I need is to use the FltGetVolumeFromName with a generic string that I create (without the FltGetFileNameInformation).
But using the FltGetFileNameInformation and with a correct nameInfo->Volume value (tested in debugger) the FltGetVolumeFromName fail with BSOD.
So how the FltGetVolumeFromName is to be used?
Suppose that the string containing the volume name is created not by FltGetVolumeFromName, but in some other way.

Thank’s

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: luned? 16 gennaio 2006 17.28
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Again, are you calling FltParseFileNameInformation? (You didn’t show it.)
That is needed to set nameInfo->Volume.

Otherwise, I don’t see anything particularly wrong, although I haven’t used
FltGetVolumeFromName.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 10:45 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Thank’s Ken,

I’m new to minifilter and my example is wrong, what I really want to do is:
0) starting from a pre create callback to
\device\HarddiskVolume1\Test\Pippo.txt

  1. create a file path such as \device\HarddiskVolume2\Test2\Pluto.txt
  2. Using FltCreateFile, test the existence of the point’s 1 file

So I need to get the instance and before, the PFLT_VOLUME of
\device\HarddiskVolume2

If I use the FltGetVolumeFromName with the \device\HarddiskVolume2
VolumeName, the system go on BSOD.

Now I’m writing a cache that hold the VolumeName/Instance values and a
function that find the filter instance getting the file full path.
It seems to work, but I would know where I’m wrong in the first method.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: luned? 16 gennaio 2006 15.57
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltGetVolumeFromName

Since this is pre-Create, the file hasn’t been opened yet, so you shouldn’t
use FLT_FILE_NAME_OPENED – probably should be FLT_FILE_NAME_NORMALIZED.

Are you calling FltParseFileNameInformation? (You didn’t show it.) That is
needed to set nameInfo->Volume.

But if you’re getting the correct volume name, it’s difficult to see what
the problem is.

An alternate approach would be to call FltGetVolumeName() to get a list of
the volume names and match it that way.

HTH,
Ken


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gian-luca Tenti
Sent: Monday, January 16, 2006 9:27 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetVolumeFromName

Hi,

in a IRP_MJ_CREATE’s Pre operation callback, I call the FltCreateFile to
open a file in another volume.

To avoid a loop,
I have to get the Instance of my filter for that volume and so I call the
FltGetVolumeFromName to obtain the pVolume pointer and then call the
FltenumerateInstance. But when I call the FltGetVolumeFromName the system go
on BSOD.

I’ve the same result even with a code like this

FLT_PREOP_CALLBACK_STATUS

SpyPreOperationCallback (

IN OUT PFLT_CALLBACK_DATA Data,

IN PCFLT_RELATED_OBJECTS FltObjects,

OUT PVOID *CompletionContext

)

.

PFLT_VOLUME Volume = NULL;

status = FltGetFileNameInformation( Data,FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_DEFAULT,&nameInfo );

status =
FltGetVolumeFromName(FltObjects->Filter,&nameInfo->Volume,&Volume);

The Filter pointer and the Volume’s name are correct.

The FltCreateFile exit with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER
((NTSTATUS)0xC0000369L) if I give an instance of a another volume from which
the file that I want to open belong.

Thank’s


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@ibsnetwork.it
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Good afternoon,
I’m developing a filter driver to read all the volume in the system and get the GUID for the same so that I can apply encryption/Decryption for the desired volume. so, first i’m working on getting all the volume int he system using FltGetVolumeName, below is the code for the same.
--------------------------------- code ---------------------------------------------------
FLT_PREOP_CALLBACK_STATUS PreFileOperationCallback(__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects, __deref_out_opt PVOID* CompletionContext)
{
DbgPrint(“\n-------Inside —PreFileOperationCallback--------”);
NTSTATUS status, ntStatus;
//PFLT_INSTANCE retInstance = NULL;
PFLT_VOLUME pVolumeList[MAX_VOLUME_CHARS];
ULONG VolumeListSize = MAX_VOLUME_CHARS;
ULONG VolumeNameLength, index = 0;
PULONG NumberVolumesReturned = NULL;
WCHAR wszNameBuffer[SHORT_NAME_LEN] = { 0 };
FILTER_VOLUME_INFORMATION_CLASS FilterVolumeStandardInformation;
FILTER_VOLUME_STANDARD_INFORMATION FltVolumeStdInfo;
PULONG BufferSizeNeeded;
SIZE_T bytesRequired;
ULONG MEMTAG_VOL_GUID = 0;
PVOLUME_CONTEXT volumeContext = NULL;
UNICODE_STRING volumeGuidName, VolumeNameString;
PVOID VolumeNameBuffer = NULL;

DbgPrint("\n---------Before FltEnumerateVolumes--------");
ntStatus = FltEnumerateVolumes(fileHandler, pVolumeList, VolumeListSize, &NumberVolumesReturned);   //Get volume information
if (!NT_SUCCESS(ntStatus)) {
 	return ntStatus;
}
DbgPrint("\n-------After  FltEnumerateVolumes---------");
DbgPrint("\nNumberVolumesReturned - %d",NumberVolumesReturned);
DbgPrint("\n-------------------------------------------");
for (index = 1; index <= NumberVolumesReturned; index++)
{
	if (index == NumberVolumesReturned) {
		break; //break from forLoop
	}
	VolumeNameString.Length = MAX_VOLUME_LENGTH;
	VolumeNameString.Buffer = wszNameBuffer;
	VolumeNameString.MaximumLength = SHORT_NAME_LEN * sizeof(WCHAR);
	DbgPrint("\n---------(1) Before FltGetVolumeName --------");
	//  Query the volume name length.
	ntStatus = FltGetVolumeName(pVolumeList[index], NULL, &VolumeNameLength);   
	DbgPrint("\n-------------------------------------------");
	if ((!NT_SUCCESS(ntStatus) && ntStatus != STATUS_BUFFER_TOO_SMALL)) {
		return FLT_PREOP_SUCCESS_NO_CALLBACK;
	}
	//  Allocate a buffer for the name.
	ntStatus = STATUS_SUCCESS;
	VolumeNameLength += (VolumeNameLength + VolumeNameLength); //increase size to allocate more PagePool memory
	VolumeNameString.Length = (ULONG)VolumeNameLength;
	VolumeNameBuffer = ExAllocatePoolWithTag(PagedPool, VolumeNameLength, MEMTAG_VOL_GUID);

	if (VolumeNameBuffer == NULL) {
		ntStatus = STATUS_INSUFFICIENT_RESOURCES;
		break;
	}
	RtlInitEmptyUnicodeString(&VolumeNameString, VolumeNameBuffer, (ULONG)VolumeNameLength);

	ntStatus = FltGetVolumeName(pVolumeList[index], &VolumeNameString, NULL);   //Get name using volume information & with max pagePool memory
	DbgPrint("\n-------- Buffered FltGetVolumeName ---------");
	DbgPrint("\nVolumeNameString Length - %ld",VolumeNameString.Length);
	DbgPrint("\nVolumeNameString Buffer - %s", (PWCH)VolumeNameString.Buffer);   //Arun Please review this point
	DbgPrint("\nVolumeNameString MaximumLength-%ld",VolumeNameString.MaximumLength);
	DbgPrint("\n------------------------------");
}//End of Index forLoop

for (index = 0; index < NumberVolumesReturned; index++)
{
	FltObjectDereference(pVolumeList[index]);
}
//return pInstance;   
return FLT_PREOP_SUCCESS_NO_CALLBACK;

}

--------------------- The output is -----------------
VolumeNameString Length - 36
VolumeNameString Buffer -
VolumeNameString MaximumLength- 36

But the Microsoft documentation for FltGetVolumeName function says,
//A pointer to a caller-allocated UNICODE_STRING structure that contains the volume’s non-persistent device object name (for example, “\Device\HarddiskVolume1”)
Im unable to get the complete “\Device\HarddiskVolume1” information.
I need help on this.

This thread is 13(!) years old…Start a new one if you have a question