How to build a IRP for rename ?

NTFSD
1

How to build a IRP for rename ?
Which parameters need to set ?

2

The parameters you need to set are:

  • Irp->AssociatedIrp.SystemBuffer pointing to a
    FILE_RENAME_INFORMATION structure that you also have
    to fill accordingly.
  • IrpSp->MajorFunction set to IRP_MJ_SET_INFORMATION
  • IrpSp->Parameters.SetFile.FileInformationClass set
    to FileRenameInformation.
  • IrpSp->Parameters.SetFile.Length (length in bytes of
    Irp->AssociatedIrp.SystemBuffer)
  • IrpSp->FileObject
  • IrpSp->Parameters.SetFile.FileObject
  • IrpSp->Parameters.SetFile.ReplaceIfExists

This list should get you started. I also recommend
reading the NT Insider article “Cracking Rename
Operations” and the IFS documentation page on
IRP_MJ_SET_INFORMATION.

Finally, to get a better understanding on rename
operations, you should use the IrpTracker and File Spy
utilities (available on OSR Online) to track “live”
rename operations.

Best regards,
Razvan

— Leo wrote:

> How to build a IRP for rename ?
> Which parameters need to set ?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________
Yahoo! Mail - PC Magazine Editors’ Choice 2005
http://mail.yahoo.com

3

Thanks.
I will try…
“Razvan Hobeanu” wrote in message
news:xxxxx@ntfsd…
> The parameters you need to set are:
>
> - Irp->AssociatedIrp.SystemBuffer pointing to a
> FILE_RENAME_INFORMATION structure that you also have
> to fill accordingly.
> - IrpSp->MajorFunction set to IRP_MJ_SET_INFORMATION
> - IrpSp->Parameters.SetFile.FileInformationClass set
> to FileRenameInformation.
> - IrpSp->Parameters.SetFile.Length (length in bytes of
> Irp->AssociatedIrp.SystemBuffer)
> - IrpSp->FileObject
> - IrpSp->Parameters.SetFile.FileObject
> - IrpSp->Parameters.SetFile.ReplaceIfExists
>
> This list should get you started. I also recommend
> reading the NT Insider article “Cracking Rename
> Operations” and the IFS documentation page on
> IRP_MJ_SET_INFORMATION.
>
> Finally, to get a better understanding on rename
> operations, you should use the IrpTracker and File Spy
> utilities (available on OSR Online) to track “live”
> rename operations.
>
> Best regards,
> Razvan
>
> — Leo wrote:
>
>> How to build a IRP for rename ?
>> Which parameters need to set ?
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as:
>> xxxxx@yahoo.com
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>>
>
>
>
>
>
> __________________________________
> Yahoo! Mail - PC Magazine Editors’ Choice 2005
> http://mail.yahoo.com
>