a CreateFile issuse

NTFSD
1

as we all know tht via a CreateFile function to create/open files drivers from user mode,and MSDN tells:

HANDLE CreateFile(
LPCTSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile
);
now if i put a path string “c:\mytext.txt” as lpFileName and run CreateFile API,if i can get this lpFileName parameter in my file filter driver’s IRP_MJ_CREATE routine? and how? i’ve tried to get a FileObject inside tht IRP Stack,it was nothing with it’s FileName ; any body knows tht? thank you very much;

have a nice day

2

> now if i put a path string “c:\mytext.txt” as lpFileName and run

CreateFile API,if i can get this lpFileName
parameter in my file filter driver’s IRP_MJ_CREATE routine? and how?

FileObject->FileName will be \mytext.txt in MJ_CREATE path of the driver.

Note that this is only true before sending the IRP down via IoCallDriver.
After this, the name is lost forever (at least on some FSDs on some Windows
versions).

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

If you want a start on how to get file names in a legacy filter driver have
a look at filespy sample source. If you want to get file names in a
mini-filter it’s a bit easier - have a look at minispy and ctx sample
source.

wrote in message news:xxxxx@ntfsd…
> as we all know tht via a CreateFile function to create/open files drivers
> from user mode,and MSDN tells:
>
> HANDLE CreateFile(
> LPCTSTR lpFileName,
> DWORD dwDesiredAccess,
> DWORD dwShareMode,
> LPSECURITY_ATTRIBUTES lpSecurityAttributes,
> DWORD dwCreationDisposition,
> DWORD dwFlagsAndAttributes,
> HANDLE hTemplateFile
> );
> now if i put a path string “c:\mytext.txt” as lpFileName and run
> CreateFile API,if i can get this lpFileName parameter in my file filter
> driver’s IRP_MJ_CREATE routine? and how? i’ve tried to get a FileObject
> inside tht IRP Stack,it was nothing with it’s FileName ; any body knows
> tht? thank you very much;
>
> have a nice day
>