FilterMgr question - loopback path

NTFSD
1

Hello,

I ran "subst x: c:" command, then I executed x:\notepad.exe
and in PostCreate callback, I’d like to find out I’m going to open “x:\notepad.exe” and not “c:\notepad.exe”

FileObject.FileName is: \notepad.exe
FileObject.DeviceObject.DeviceType: 7 (FILE_DEVICE_DISK)

FltGetFileNameInformation( …, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo );
returns:
nameInfo.Name: \Device\HarddiskVolume1\notepad.exe
nameInfo.Volume: \Device\HarddiskVolume1
nameInfo.ParentDir: \

If I receive volume context, it’s the same like for C: volume

How is it possible to receive “X:” volume name for such requests?

thanks,
Petr

2

There isn’t necissarily any mapping between \DosDevices and \Devices. In
this case you would have two mappings, one for C and one for X, the
entries in \DosDevices are just symlinks (that eventually) end up pointing
to \Device\HarddiskVolume… (this is in the IFS FAQ btw) There is simply
no way to know which \DosDevices symlink was traversed to get to your
device since that traversal all happens in the object manager.

If you want to somehow layer special semantics based on the path involved
at the win32 layer you might want to consider using a CIFS loopback mount
and filtering the rdr mount.

t.

On Sun, 10 Dec 2006, Petr Kurtin wrote:

Hello,

I ran "subst x: c:" command, then I executed x:\notepad.exe
and in PostCreate callback, I’d like to find out I’m going to open “x:\notepad.exe” and not “c:\notepad.exe”

FileObject.FileName is: \notepad.exe
FileObject.DeviceObject.DeviceType: 7 (FILE_DEVICE_DISK)

FltGetFileNameInformation( …, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo );
returns:
nameInfo.Name: \Device\HarddiskVolume1\notepad.exe
nameInfo.Volume: \Device\HarddiskVolume1
nameInfo.ParentDir: \

If I receive volume context, it’s the same like for C: volume

How is it possible to receive “X:” volume name for such requests?

thanks,
Petr

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com