Hi.
Many comments have noted that recursively synthesizing a fully-qualified filepath from the RelatedPath fields of FILE_OBJECTs should only be done during IRP_MJ_CREATE, because the path components can be deleted by NT at any time. Isn’t it also true that the RelatedPath components are also valid during file rename; ie, IRP_MJ_SET_INFORMATION?
I have also seen in seveal places that, rather than using the recursive method, it is better to build an IRP and calling ZwQueryInformationFile with a FILE_INFORMATION_CLASS value of FileRenameInformation. This value is unfortunately not present in the corresponding enumeration of FILE_INFORMATION_CLASS for Win98 – there are only four values listed in wdm.h, whereis for NT there are over 40 for NT! Hence, this method doesn’t seem that it will work for WDM driver that needs to run on both NT and 98. Does anyone know how to get the complete filepath info in 98? If the recursive method must be used, can we count on 98 not to delete any of the path name entries for non-create/rename IRPs?