FltGetVolumeFromName

NTFSD
1

Hi,

I am writing minifilter, FltGetVolumeFromName is constantly being crashed in PreOperation Callback, when I intercepting IRP_MJ_CREATE.

Is there any reason , can anybody help me.

Thanks.

2

Sure. It works fine, so you did something wrong. Without more info, we can’t
help much.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Friday, April 17, 2009 12:39 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetVolumeFromName

Hi,

I am writing minifilter, FltGetVolumeFromName is constantly being crashed in
PreOperation Callback, when I intercepting IRP_MJ_CREATE.

Is there any reason , can anybody help me.

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Hi ken,

I used minifilter sample, and just added in IRP_MJ_CREATE as following;

FLT_PREOP_CALLBACK_STATUS returnStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; //assume we are NOT going to call our completion routine
PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
UNICODE_STRING defaultName;
PUNICODE_STRING nameToUse;
PFLT_VOLUME ptVolume;
UNICODE_STRING ustrVolume;
NTSTATUS status, nStatus;
PVOID buffer = NULL;

DbgPrint(“Post Operation\n”);
RtlInitUnicodeString(&ustrVolume,L"C:");
if (FltObjects->FileObject != NULL) {

status = FltGetFileNameInformation( Data,
FLT_FILE_NAME_NORMALIZED |
KLData.NameQueryMethod,
&nameInfo );

} else {

//
// Can’t get a name when there’s no file object
//

status = STATUS_UNSUCCESSFUL;
}

//
// Use the name if we got it else use a default name
//

if (NT_SUCCESS( status )) {

nameToUse = &nameInfo->Name;

//
// Parse the name if requested
//

status = FltParseFileNameInformation( nameInfo );
ASSERT(NT_SUCCESS(status));

} else {

//
// We were unable to get the String safe routine to work on W2K
// Do it the old safe way
//

RtlInitUnicodeString( &defaultName, L"" );
nameToUse = &defaultName;

}

//
// Release the name information structure (if defined)
//

if (NULL != nameInfo) {

FltReleaseFileNameInformation( nameInfo );
}
if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {

nStatus = FltGetVolumeFromName(KLData.Filter,&ustrVolume,&ptVolume);

if(NT_SUCCESS(nStatus))
FltObjectDereference(ptVolume);
}

if (Data->Iopb->MajorFunction == IRP_MJ_SHUTDOWN) {

//
// Since completion callbacks are not supported for
// this operation, do the completion processing now
//

KLPostOperationCallback( Data,
FltObjects,
NULL,
0 );

returnStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;

} else {

*CompletionContext = NULL;
returnStatus = FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

return returnStatus;

Plz, let me know if there any issue

4

Call FltGetVolumeFromName before you call FltReleaseFileNameInformation.