Sorry for this cross post, but actually this question is meant for the
winDbg list not fsd. May be experts in this forum can answer it.
In NtSetInformationFile(…) if the FileInformationClass parameer is set to
“FileRenameInformation” it means a rename operation.
Now, can this information be used in windbg to find out (from the other
parameters) what file was renamed and to what is it’s new name( all the
three cases of rename discussed in the OSR "cracking rename paper ) ?
regards
–
- amitr0