I am new to filter drivers. I have a user mode scan function to scan files. I need to retrieve the filename from the minifilter to pass it to the app. I was told that the filename is guaranteed to be valid only in pre-create. Should I call FltGetFileNameInformation() in pre-create, store it in some contextand then use it in post-create? I intend to pass the file name up using a notification field. Is this a reliable way of doing it?
Or should I use the FileObject field in PreCreate() to get the filename?
I tried FltGetFileNameInformation() in precreate but the nameInfo->Name.Length is never valid. So I am not sure if I am missing something.
I dont have permissions to do kernel logging on my machine and hence have limited debug capabilities. The only way I can tell if the file name is correct is by passing it up in the notification ( I created a UCHAR FileName[512] field in the notification structure) and printing it in user space.
What do you mean when you say that the name length is not valid? Was the
status to the FltGetFileNameInformation success?
How are you coping the name to a UCHAR string? The file name is not a char
string, it is a UNICODE_STRING which contains WCHARs without a terminating
NULL character.
I am new to filter drivers. I have a user mode scan function to scan files.
I need to retrieve the filename from the minifilter to pass it to the app. I
was told that the filename is guaranteed to be valid only in pre-create.
Should I call FltGetFileNameInformation() in pre-create, store it in some
contextand then use it in post-create? I intend to pass the file name up
using a notification field. Is this a reliable way of doing it?
Or should I use the FileObject field in PreCreate() to get the filename?
I tried FltGetFileNameInformation() in precreate but the
nameInfo->Name.Length is never valid. So I am not sure if I am missing
something.
I dont have permissions to do kernel logging on my machine and hence have
limited debug capabilities. The only way I can tell if the file name is
correct is by passing it up in the notification ( I created a UCHAR
FileName[512] field in the notification structure) and printing it in user
space.
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit: http://www.osr.com/seminars
If you don’t have a system with full administrator access, you can never get
this working. You can NOT develop drivers without a target (debug) system
connected via 1394a, serial, or USB. Don’t even bother to try.
wrote in message news:xxxxx@ntfsd… > Hi > > I am new to filter drivers. I have a user mode scan function to scan > files. I need to retrieve the filename from the minifilter to pass it to > the app. I was told that the filename is guaranteed to be valid only in > pre-create. Should I call FltGetFileNameInformation() in pre-create, store > it in some contextand then use it in post-create? I intend to pass the > file name up using a notification field. Is this a reliable way of doing > it? > > Or should I use the FileObject field in PreCreate() to get the filename? > > I tried FltGetFileNameInformation() in precreate but the > nameInfo->Name.Length is never valid. So I am not sure if I am missing > something. > > I dont have permissions to do kernel logging on my machine and hence have > limited debug capabilities. The only way I can tell if the file name is > correct is by passing it up in the notification ( I created a UCHAR > FileName[512] field in the notification structure) and printing it in user > space. > > > > >