Hi, all,
I found a bug in the FileSpy driver from IFS Kit 2003.
In the SpyGetFullPathName, case 1 (volume open),
there is a note that “we’ve already copied the VolumeName
so just return”
But this is true only if the FO_DIRECT_DEVICE_OPEN
was in the FileObject->Flags. For the redirector,
FileSpy logs an empty string almost always when
I/O operation is performed on the volume itself.
I fixed this problem by adding code into the “case 1”
(Is it a correct approach ?)
//
// We’ve already copied the VolumeName so just return.
// Ladik: But if not, use ObQueryNameString
// against FileObject->DeviceObject
//
if(FileName->Length == 0)
{
POBJECT_NAME_INFORMATION objNameInfo =
(POBJECT_NAME_INFORMATION)buffer;
ULONG Length = sizeof(buffer);
status = ObQueryNameString(FileObject->DeviceObject,
objNameInfo,
Length,
&Length);
if(NT_SUCCESS(status))
{
RtlAppendUnicodeStringToString(FileName, &objNameInfo->Name);
}
}
L.