Get File Size when filtering the lanmanredirector device

NTFSD
1

Hi!

I have written a filter driver that filters \Device\Lanmanredirector.

I am able to get the file name that is being opened, but I can’t get it’s size.

Can anyone help me with finding the file size?

Thanks in advance!

2

FltQueryInformationFile (or ZwQueryInformationFile) with
FileStandardInformation.

/Daniel

wrote in message news:xxxxx@ntfsd…
> Hi!
>
> I have written a filter driver that filters \Device\Lanmanredirector.
>
> I am able to get the file name that is being opened, but I can’t get it’s
> size.
>
> Can anyone help me with finding the file size?
>
>
>
> Thanks in advance!
>

3

Can you explain how I can use it? I am catching the IRP_MJ_READ IRP, and in this function I want to

get the file size being opened. Can you explain how I can get the file size in this function?

Thanks!

4

I could write this code for you, but what fun is that ? It is not clear
whether you are using a minifilter or a legacy filter so I provide no
sample. If it is not challenging for you to read the doc, do some googling,
or just give it a try, I wonder how far you are (not) going to get in the
face of some real problems.

/Daniel

wrote in message news:xxxxx@ntfsd…
> Can you explain how I can use it? I am catching the IRP_MJ_READ IRP, and
> in this function I want to
>
> get the file size being opened. Can you explain how I can get the file
> size in this function?
>
> Thanks!
>

5

Alright, I found that I can get the size of the file being read this way:

PIO_STACK_LOCATION pIoStackIrp = NULL;
ULONG FileSize;

pIoStackIrp = IoGetCurrentIrpStackLocation(Irp);

FileSize = pIoStackIrp->Parameters.Read.Length;

But when I open big files, I have several READ IRP’s, and every IRP has a portion of 4096 bytes.

How can I get the whole file size?

I’m writing a filter driver.

Thanks!