hi,
I want to get the file name when the Parameters.Create.Options is FILE_OPEN_BY_FILE_ID ,so I use ObOpenObjectByPointer() to return a file handle in IRP_MJ_CREATE,then use ZwQueryInformationFile() to obtain the file name.
like this:
case IRP_MJ_CREATE:
if(FileObject)
{
HANDLE handle=NULL;
status = ObOpenObjectByPointer( irpSp->FileObject,
OBJ_KERNEL_HANDLE,
NULL,
0,
NULL,
KernelMode,
&handle );
if(NT_SUCCESS( status ))
{
…//Get the File name
ZwClose(handle);
}
}
but the os is dumped ,and "Process1_initialization_failed"is shown.
Can you tell me what I am doing wrong?
thanks.
zhou