Getting Drive Letter

NTFSD
1

I want to get Driver/Volume Complete Name (e.g. Local Disc (C:) ), and i read this thread
http://www.osronline.com/showThread.cfm?link=50140

I found this ‘IoVolumeDeviceToDosName’ routine. I also ask a question on stackoverflow at this link

“http://stackoverflow.com/questions/14092677/fileobject-filename-not-returning-complete-path-of-a-file#comment19495218_14092677”

But i’m still unable to get volume name.

what i’m trying is

PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;
DbgPrint(“File Name : %wZ\n”, &pFileObject->FileName);

if(pFileObject->Vpb != NULL)
{
IoVolumeDeviceToDosName(pFileObject->Vpb->RealDevice, buf);
DbgPrint(“Volume Name : %wZ\n”, &buf);
}
else
{
DbgPrint(" Vpb is null… ");
}

This prints file path exactly correct but also displays “Vpb is null”.

Please help me, what i’m doing wrong…!

2

If it is printing both strings for the same volume, then there’s something wrong with your compiler.

Tony
OSR

3

Actually file path is displayed by this line
DbgPrint(“File Name : %wZ\n”, &pFileObject->FileName);

and I’m getting ‘pFileObject->Vpb’ always ‘NULL’.

Please suggest me am i doing correct or is something wrong… Or any otherway of finding volume name…?

4

You have to set the FileObject->Vpb = VCB->Vpb at the IRP_MJ_CREATE (here I wrote VCB->Vpb, because we save the Vpb in the VCB usually).

5

At what point are you seeing this?

A Vpb pointer is never valid for non-physical media file systems. It’s valid for physical file systems in the post create path.

Tony
OSR

6

@adnan : Thanks for your repsonse, but i still didn’t get it…

7

@Tony Mason

I’m a newbie and writing first Filter Driver by following this tutorial.
File System Filter Driver Tutorial:
“http://www.codeproject.com/Articles/43586/File-System-Filter-Driver-Tutorial”

It display’s path of file without volume label, now i’m trying to adding this functionality in it.

And i read this thread for volume label / drive letter.
Getting Drive Letter:
“http://www.osronline.com/showThread.cfm?link=50140”

// Here are my changing, except this function all other code is same as described in File System Filter Driver Tutorial.

NTSTATUS FsFilterDispatchCreate(
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
{
PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;

DbgPrint(“File Name : %wZ\n”, &pFileObject->FileName); // displays file path

WCHAR stringBuffer[300];
UNICODE_STRING string1;

string1.Buffer = stringBuffer;
string1.Length = 0x0;
string1.MaximumLength = sizeof(stringBuffer);

PUNICODE_STRING buf = &string1;

if(pFileObject->Vpb != NULL)
{
IoVolumeDeviceToDosName(pFileObject->Vpb->RealDevice, buf);
DbgPrint(“Volume Name : %wZ\n”, &buf);
}
else
{
DbgPrint(" Vpb is null… ");
}
}

Here i’m getting “Vpb is null…”.

8

Vpb is possibly NULL because the Vpb is set on the FileObject at the IRP_MJ_CREATE at the File System level. So you will not have it available at the FsFilterDispatchCreate.

Yes you can catch it (only if the File System have set it, NTFS FAT does it) in the PostCreate.

For filter driver, Did you try using the DeviceObject (from arguments).
Or did you try using the pExt->AttachedToDeviceObject.

9

Not possibly, actually. It is the responsibility of the FSD to set up the VPB pointer properly - the I/O manager does not do this.

The OP is doing this in pre-create and it just hasn’t been set yet. This underscores one of the challenges of filters: you need to understand how file systems work. In fact, you need to understand them at least as well as the file systems writers do.

Tony
OSR