How can i get a full pathname in IRP_MJ_CREATE dispath routine?
Best Regards
Ken Wang
The question itself presumes that there is a full pathname to retrieve,
which isn’t necessarily the case.
If we ignore those cases where a path name is not available, you obtain
it (in *dispatch* as you specified) by taking the name in the file
object and combining it with the name you previously stored (usually in
a table) for the RelatedFileObject field (not often used). The name of
the current file object is in the FileName field. If there is no
RelatedFileObject, that is the entire name of the file - including path
- that will be given to the file system, relative to the root of the
volume.
You cannot safely use the RelatedFileObject->FileName; while it might
appear to work properly for you to use that information, there is no
guarantee that this is true.
The cases in which you cannot obtain a full path name in IRP_MJ_CREATE
would include the open by file ID and open by object ID cases (where a
64 bit or 128 bit number are used to identify the file). In such a
case, you can obtain a path by opening the file and querying the file
system for the name. I do want to emphasize that you will only receive A
path to the file. If the file has multiple paths to it (e.g., hard
links) then what you get back is “arbitrary” (and determined by the
specific underlying file system). If the context in which you are
operating does not have SeChangeNotify privilege (rare, but it can
happen) you cannot query the path (you will get back
STATUS_ACCESS_DENIED or STATUS_PRIVILEGE_NOT_HELD as I recall). Perhaps
you do not care about these cases, but they do exist.
One other thing to keep in mind here: the “root of the volume” may not
mean beginning at the drive letter. If someone uses a volume mount
point, then the “root of the volume” will be relative to that volume
mount point - not relative to the drive letter. For example, I
routinely use this on my development system, so even though I have 10
disks attached to the system, it appears as if there is only a single
drive letter - C: with specific volumes “mounted” within subdirectories.
Unfortunately, what many people believe is simple (obtaining the “name”
of a file) is actually one of the more complicated aspects of Windows
file systems. The rich naming environment supported by the OS
translates into a correspondingly complex implementation model for a
file system filter that wishes to determine the name.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@lenovo.com
Sent: Saturday, February 26, 2005 1:31 AM
To: ntfsd redirect
Subject: [ntfsd] How can i get a full pathname in IRP_MJ_CREATE dispath
routine?
How can i get a full pathname in IRP_MJ_CREATE dispath routine?
Best Regards
Ken Wang
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Ken,
Tony gave a very nice description. I want to point out if you implement
your filter as a minifilter using the filter manager it comes with APIs
that do all of this work for you.
Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Saturday, February 26, 2005 5:56 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] How can i get a full pathname in IRP_MJ_CREATE
dispath routine?
The question itself presumes that there is a full pathname to retrieve,
which isn’t necessarily the case.
If we ignore those cases where a path name is not available, you obtain
it (in *dispatch* as you specified) by taking the name in the file
object and combining it with the name you previously stored (usually in
a table) for the RelatedFileObject field (not often used). The name of
the current file object is in the FileName field. If there is no
RelatedFileObject, that is the entire name of the file - including path
- that will be given to the file system, relative to the root of the
volume.
You cannot safely use the RelatedFileObject->FileName; while it might
appear to work properly for you to use that information, there is no
guarantee that this is true.
The cases in which you cannot obtain a full path name in IRP_MJ_CREATE
would include the open by file ID and open by object ID cases (where a
64 bit or 128 bit number are used to identify the file). In such a
case, you can obtain a path by opening the file and querying the file
system for the name. I do want to emphasize that you will only receive A
path to the file. If the file has multiple paths to it (e.g., hard
links) then what you get back is “arbitrary” (and determined by the
specific underlying file system). If the context in which you are
operating does not have SeChangeNotify privilege (rare, but it can
happen) you cannot query the path (you will get back
STATUS_ACCESS_DENIED or STATUS_PRIVILEGE_NOT_HELD as I recall). Perhaps
you do not care about these cases, but they do exist.
One other thing to keep in mind here: the “root of the volume” may not
mean beginning at the drive letter. If someone uses a volume mount
point, then the “root of the volume” will be relative to that volume
mount point - not relative to the drive letter. For example, I
routinely use this on my development system, so even though I have 10
disks attached to the system, it appears as if there is only a single
drive letter - C: with specific volumes “mounted” within subdirectories.
Unfortunately, what many people believe is simple (obtaining the “name”
of a file) is actually one of the more complicated aspects of Windows
file systems. The rich naming environment supported by the OS
translates into a correspondingly complex implementation model for a
file system filter that wishes to determine the name.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@lenovo.com
Sent: Saturday, February 26, 2005 1:31 AM
To: ntfsd redirect
Subject: [ntfsd] How can i get a full pathname in IRP_MJ_CREATE dispath
routine?
How can i get a full pathname in IRP_MJ_CREATE dispath routine?
Best Regards
Ken Wang
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com