How can I get long path from short path in kernel mode ?

NTFSD
1

Hi, all

How can I get the long path from the short path in file system filter driver?
I want to get it in pre-create.

Thanks.

2

if you have the WDK from microsoft this should be fairly simple. They have the NameLookup lib, and you can use NlGetFullPathName with NameLookupFlags: NLFL_IN_CREATE (pre create is also accepted).
The NT file naming environment is very redundant as far as I am concerned. If you are designing a legacy fs filter driver, in pre-create you have the fileobject structure which should provide you with enough information to query the dos/nt/guid path of the file. be more explicit, with what you got and what you want to get

3

Thank you, Gabriel .

When wordpad.exe opens a file, the file name comes into IRP_MJ_CREATE dispatch routine with short path. File Object 's FileName Buffer is formed of short path.
I want to compare that files with my files - they are formed of long path.

NameLookup.lib also gets short path in pre create when file object structure has short path file name.

How can I compare or convert file path from short to long ?

4

Assuming you cannot find a library that already does what you want, the algorithm for converting a short path to a long path would be to walk the path, component by component, and look up each entry in the directory.

Directory enumeration takes a search string. Give it the name that you have; in return you get a directory entry in the format that you requested (any of them should do for your purposes.) Extract the name from there (because the name will always be the long name component, if there is a distinct short name that will be filled in as well.) Add your separator character.

After iterating through the entire path, you’ll have the long path name.

Keep in mind that since you want to do this in the pre-create path, you will need to handle the various error conditions that can arise, including:

  • Security may prevent the current thread context from enumerating the contents of a directory (having “traverse” privilege does not mean you have the right to enumerate the directory contents.)
  • The path you are given may not be valid
  • Standard issues that can arise, such as allocation failure, handling strings that are longer than you’d expected, etc.
  • Paths that never terminate (e.g., cross-mounted volumes.) That probably falls into the “strings that are too long” category, but you do need to handle this error case.

I’d expect a robust implementation of this to be at least a thousand lines of code, probably more, as this is a significant piece of work.

Good luck!

Tony
OSR