Get FileObject by name?

NTFSD
1

Hi All,

I want to get the FileObject by file name, while testing the following
codes,
always get error STATUS_OBJECT_TYPE_MISMATCH. Have tried
the IoFileObjectType, IoDeviceObjectType and NULL type, same error
returned.
…
( put in pFileName: L"\Device\HarddiskVolume2\temp\test.txt" )
(creat this file by ZwCreateFile(…) success)
(ObReferenceObjectByHandle(…) success, got the good FileObject)
…
PFILE_OBJECT fileObj = NULL;
NTSTATUS status = STATUS_UNSUCCESSFUL;
status = ObReferenceObjectByName( pFileName, OBJ_CASE_INSENSITIVE,
NULL, 0L, *IoFileObjectType, KernelMode, NULL, (PVOID *)&fileObj );
…

I can get FileObject by ZwCreateFile(…) then
ObReferenceObjectByHandle(…)
with no problem. But file handle is process context based, if I can get the
FileObject
by name directly, it will save me a lot. So does the
ObReferenceObjectByName(…)
work for this case? and if it works, what’s wrong in my test codes? Any
hints?

Thanks,

AFei

2

You can use OBJ_KERNEL_HANDLE to get a handle that is
valid across all processes (requires W2K or greater
OS).

I haven’t used ObReferenceObjectByName.

— AFei wrote:

> Hi All,
>
> I want to get the FileObject by file name, while
> testing the following
> codes,
> always get error STATUS_OBJECT_TYPE_MISMATCH. Have
> tried
> the IoFileObjectType, IoDeviceObjectType and NULL
> type, same error
> returned.
> …
> ( put in pFileName:
> L"\Device\HarddiskVolume2\temp\test.txt" )
> (creat this file by ZwCreateFile(…) success)
> (ObReferenceObjectByHandle(…) success, got the
> good FileObject)
> …
> PFILE_OBJECT fileObj = NULL;
> NTSTATUS status = STATUS_UNSUCCESSFUL;
> status = ObReferenceObjectByName( pFileName,
> OBJ_CASE_INSENSITIVE,
> NULL, 0L, *IoFileObjectType, KernelMode, NULL,
> (PVOID *)&fileObj );
> …
>
> I can get FileObject by ZwCreateFile(…) then
> ObReferenceObjectByHandle(…)
> with no problem. But file handle is process context
> based, if I can get the
> FileObject
> by name directly, it will save me a lot. So does the
> ObReferenceObjectByName(…)
> work for this case? and if it works, what’s wrong in
> my test codes? Any
> hints?
>
> Thanks,
>
> AFei
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

3

No it does not work. File objects are unnamed - they have no Object
Manager’s names in them.
If you want to get the file object corresponding to the given disk
pathname - use ZwCreateFile and then ObReferenceObjectByHandle.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “AFei”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, August 06, 2004 5:17 AM
Subject: [ntfsd] Get FileObject by name?

> Hi All,
>
> I want to get the FileObject by file name, while testing the following
> codes,
> always get error STATUS_OBJECT_TYPE_MISMATCH. Have tried

4

Hi Randy & Maxim,

You are right, the File objects can not be referenced by name
because they are not the named objects in IO manager.
This also explained that they can not be seen in WinObj.
thanks,

AFei