How to convert given path to long path in kernel mode?

NTFSD
1

Hi All,

I want to track the a particular file.

Problem is that the path I got can be short or long
or combination of both (ie. some components are long
and some components are short).

E.g. Possible paths of file “c:\Abc Xyz\pqr123456.txt”
can be…
1> “c:\Abc Xyz\pqr123456.txt”
2> “c:\AbcXyz~1\pqr123~1.txt”
3> “c:\AbcXyz~1\pqr123456.txt”
4> “c:\Abc Xyz\pqr123~1.txt”

As number of components in path increases possible
combinations also increases. So I want to covert above
paths in a unique path such as long path. But I want
to convert given path in to long path in kernel mode.

Is there any way to convert given path to long path
in kernel mode?

Thanks & Regards,
Amit.

2

If you are writing a minifilter FS driver, then you can use FltGetFileNameInformation with FLT_FILE_NAME_NORMALIZED flag set.

This will give you a path as you would expect.
Do read the documentation for the API carefully.
There are some restrictions about using the API.

Further, NORMALIZED names can be expensive to get if there filters implementing name generation callbacks. So be careful about performance issues.

3

Thanks for the help.

I think this API gives the file name information about a file for which the minifilter
callbeck is called and not for any arbitary file.

My problem is that I want to convert one path in to another like GetLongPathName function
which is usermode function I want same functionality in kernel mode.

4

I doubt there is an API like GetLongPathName in the kernel.
You would have do what GetLongPathName does!
I believe it will go component by component and get the corresponding long path names.
(You can use Procmon to understand this)

The APIs that you can use are:
ZwCreateFile to open a directory
ZwQueryDirectoryFile to get the name information for the child component.

5

I’m pretty sure that I have use FltGetFileNameInformation for arbitrary
files. You need to allocate up your own FltAllocateCallbackData and fire
that in to FltGetFileNameInformation.

It must be possible because the windows firewall calls
FltGetFileNameInformation and it surely isn’t getting called by minifilter.

wrote in message news:xxxxx@ntfsd…
> Thanks for the help.
>
> I think this API gives the file name information about a file for which
> the minifilter
> callbeck is called and not for any arbitary file.
>
> My problem is that I want to convert one path in to another like
> GetLongPathName function
> which is usermode function I want same functionality in kernel mode.
>

6

Or you could open the path in your minifilter and call FltGetFileNameInformation on the FILE_OBJECT.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

7

I am surprised one can allocate a callback object and use it for purposes like these. My understanding was that Mini-Filters can allocate callbacks for purposes of doing FltPerformAsynchronousIo and FltPerformSynchronousIo requests.

While this may work correctly, I wouldn’t go down this path as the API is not meant to be called in such a manner. If it were, it should have accepted FILE_OBJECT and not a callback struct. Further, the documentation of the API does not clearly state which fields of the callback struct should be initialized with what values.

Kind of makes you rely on the function implementation and not the interface.
Similar to what Alex argued against on the other thread
“Clarification: Context reference count and FltSetStreamContext”

8

Hi All,

Thanks for the solution. I have done it using FltGetFileNameInformation.
But the problem is that I have to allocate callback data using
FltAllocateCallbackData as I am not in any minifilter callback routine.
So I dont have instance which is compalsory parameter for
FltAllocateCallbackData. Is there any other way?

If not can I use any instance as parameter to allocate callback data
for a file on any drive?

9

How about doing it in user mode?

look at following links and check Alex answers,

https://www.osronline.com/cf.cfm?PageURL=showThread.CFM?link=157169
http://www.osronline.com/showThread.cfm?link=154376

Thanks
Aditya

10

You can open the directory then do a query directory for the file?(FileBothDirectoryInformation)
You should detect if you need to convert (i.e. does the path have the “~” character?) to limit the impact.
?
Lijun
?if running in a legacy driver. Be aware of the performance as? FltGetFileNameInformation has the caching mechanism.

From: “xxxxx@yahoo.com”
To: Windows File Systems Devs Interest List
Sent: Fri, December 4, 2009 1:53:25 AM
Subject: RE:[ntfsd] How to convert given path to long path in kernel mode?

Hi All,

Thanks for the solution. I have done it using FltGetFileNameInformation.
But the problem is that I have to allocate callback data using
FltAllocateCallbackData as I am not in any minifilter callback routine.
So I dont have instance which is compalsory parameter for
FltAllocateCallbackData. Is there any other way?

If not can I use any instance as parameter to allocate callback data
for a file on any drive?

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

11

Well, actually short names don’t have to have ~ in the name (they usually do, but not always). Other than the number of characters there isn’t any reliable indicator that a certain name is not short.

Could you please elaborate on where you are calling FltGetFileNameInformation ? How does your minifilter work ? You said “But the problem is that I have to allocate callback data using
FltAllocateCallbackData as I am not in any minifilter callback routine.” so where are you ?

Could you please go through exactly what you are trying to achieve ? This thread started with “how do I convert a path to a normalized path” and now we’re talking about FILE_OBJECTs outside the context of any IO operation and I’m not sure I follow …

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

12

Sorry for late reply,

I am in Image load notification routine, and I want to compair the path
with a spacific file. As path in this notification routine can be any thing
as I explained in my first post in this thread we need to convert it in to
long path and then compair.

13

Wasn’t this question already answered last week?
You need to open the directory and then use ZwQueryDirectoryFile to get the
long name.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Sunday, December 06, 2009 11:15 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] How to convert given path to long path in kernel mode?

Sorry for late reply,

I am in Image load notification routine, and I want to compair the path with
a spacific file. As path in this notification routine can be any thing as I
explained in my first post in this thread we need to convert it in to long
path and then compair.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

14

I agree with Bill on this. You shouldn’t be using Flt… routines in this particular case, because you are not in the context of an IO operation (which is also why you don’t have an instance). You should stick to using Zw… routines.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.