filtering based on filename

NTFSD
1

I
'm working on an encryption file filter driver. This is my first endeavor in
file system world. I want to filter request based on filename but I know that
PtrIoStackLocation->FileObject.FileName field does not necessarily give me a
full (absolute) file path. I need to construct an absolute
file path but I don’t know how I can do it.

 Does one other field exist in the IRP that I extract the absolute file path from it?

2

Check out FltGetFileNameInformation[Unsafe] if yours is a minifilter (search
files below C:\WinDDK\6001.18001\src\filesys\miniFilter
for FltGetFileNameInformation to find sample usages)

or:

Look in C:\WinDDK\6001.18001\src\filesys\filter\lib
folder if yours is not a minifilter (search files under
C:\WinDDK\6001.18001\src\filesys\filter
for NLGetFullPathName)

-------------- Original message --------------
From: fatima Gh
I 'm working on an encryption file filter driver. This is my first endeavor in file system world. I want to filter request based on filename but I know that PtrIoStackLocation->FileObject.FileName field does not necessarily give me a full (absolute) file path. I need to construct an absolute file path but I don’t know how I can do it.
Does one other field exist in the IRP that I extract the absolute file path from it?

— NTFSD is sponsored by OSR For our schedule debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Fatima!

Are you developing a legacy filter or a minifilter?

In case of minifilter, it is straight forward. Just call
FltGetFileNameInformation.

In case of legacy filter, you need to build the file path manually.

  1. If FO_VOLUME_OPEN flag is set in FileObject->Flags or
    FileObject->FileName.Length = 0, it is a volume open.

  2. If FILE_OPEN_BY_FILE_ID flag is set in
    IrpSp->Parameters.Create.Options the file ID is present instead of file
    name.

  3. If FileObject->RelatedFileObject != NULL, this is a relative open.
    You need to use both the Relative objects file name and the file name
    present in the FileObject->FileName to build the full path.

  4. If FileObject->RelatedFileObject = NULL,
    FileObject->FileName.Buffer contains the full path.

Regards,

Ayush Gupta

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of fatima Gh
Sent: Tuesday, May 27, 2008 6:49 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] filtering based on filename

I 'm working on an encryption file filter driver. This is my first endeavor
in file system world. I want to filter request based on filename but I know
that PtrIoStackLocation->FileObject.FileName field does not necessarily give
me a full (absolute) file path. I need to construct an absolute file path
but I don’t know how I can do it.

Does one other field exist in the IRP that I extract the absolute file path
from it?

— NTFSD is sponsored by OSR For our schedule debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars You are currently subscribed to ntfsd as:
xxxxx@yahoo.co.in To unsubscribe send a blank email to
xxxxx@lists.osr.com