How to find name of filesystem device in fs registration hook

NTFSD
1

I use IoRegisterFsRegistrationChange() to hook FileSystem devices. My
callback receives a device object pointer. I want to find out the name
that these devices were created with (the name passed to IoCreateDevice)
to show the user.

How do I do this?

My current way of handling this is to trawl the , \Device and \FileSystem
directories of the object namespace (using ZwQueryDirectoryObject()) and
open every device (using ZwOpenFile(), ObReferenceObjectByHandle(),
IoGetRelatedDeviceObject()) to see whether its the device object I’m
looking for.

This normally works but some devices don’t like me opening them like this
and the open call never returns.

Is there a better way to do this?
Can I use IoGetDeviceInterfaces() or something similar?

Your suggestions would be greatly appreciated.

Thanks,
Richard Cartwright

2

what i did was:

try for every fsd to attach but yet to attach
{
init fsd name e.g. \ntfs
call IoGetDeviceObjectPointer with name
if success, implies correct fsd
attach!
note fsd already attached to skip trying in next round
end
}

Ampsi

----- Original Message -----
From: “Richard Cartwright”
To: “File Systems Developers”
Sent: Thursday, May 22, 2003 17:05
Subject: [ntfsd] How to find name of filesystem device in fs registration
hook

I use IoRegisterFsRegistrationChange() to hook FileSystem devices. My
callback receives a device object pointer. I want to find out the name
that these devices were created with (the name passed to IoCreateDevice)
to show the user.

How do I do this?

My current way of handling this is to trawl the , \Device and \FileSystem
directories of the object namespace (using ZwQueryDirectoryObject()) and
open every device (using ZwOpenFile(), ObReferenceObjectByHandle(),
IoGetRelatedDeviceObject()) to see whether its the device object I’m
looking for.

This normally works but some devices don’t like me opening them like this
and the open call never returns.

Is there a better way to do this?
Can I use IoGetDeviceInterfaces() or something similar?

Your suggestions would be greatly appreciated.

Thanks,
Richard Cartwright

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> what i did was:

try for every fsd to attach but yet to attach
{
init fsd name e.g. \ntfs
call IoGetDeviceObjectPointer with name
if success, implies correct fsd
attach!
note fsd already attached to skip trying in next round
end
}

Ampsi

Ok. But I don’t have a predefined list of fsds I want to attach to. I want
to attach to everything (well, everything thats a full filesystem, I
exclude any device from \FileSystem\Fs_Rec). I just want the name for
informational purposes. How can I find the name from the device object?

Is it safe to call IoGetDeviceObjectPointer() on every device I find in ,
\Device and \FileSystem?

Thanks,
Richard

----- Original Message -----
From: “Richard Cartwright”
> To: “File Systems Developers”
> Sent: Thursday, May 22, 2003 17:05
> Subject: [ntfsd] How to find name of filesystem device in fs registration
> hook
>
>
> I use IoRegisterFsRegistrationChange() to hook FileSystem devices. My
> callback receives a device object pointer. I want to find out the name
> that these devices were created with (the name passed to IoCreateDevice)
> to show the user.
>
> How do I do this?
>
> My current way of handling this is to trawl the , \Device and \FileSystem
> directories of the object namespace (using ZwQueryDirectoryObject()) and
> open every device (using ZwOpenFile(), ObReferenceObjectByHandle(),
> IoGetRelatedDeviceObject()) to see whether its the device object I’m
> looking for.
>
> This normally works but some devices don’t like me opening them like this
> and the open call never returns.
>
> Is there a better way to do this?
> Can I use IoGetDeviceInterfaces() or something similar?
>
> Your suggestions would be greatly appreciated.
>
> Thanks,
> Richard Cartwright
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@spherical.com.au
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

maybe what u can do is use IoGetDeviceObjectPointer to get a pointer to what
u don’t want to attach.

when u get called back, check if the pointer retrieved and the pointer
passed in match. attach only if they don’t match.

Ampsi

----- Original Message -----
From: “Richard Cartwright”
To: “File Systems Developers”
Sent: Friday, May 23, 2003 09:13
Subject: [ntfsd] Re: How to find name of filesystem device in fs
registration hook

> what i did was:
>
> try for every fsd to attach but yet to attach
> {
> init fsd name e.g. \ntfs
> call IoGetDeviceObjectPointer with name
> if success, implies correct fsd
> attach!
> note fsd already attached to skip trying in next round
> end
> }
>
> Ampsi

Ok. But I don’t have a predefined list of fsds I want to attach to. I want
to attach to everything (well, everything thats a full filesystem, I
exclude any device from \FileSystem\Fs_Rec). I just want the name for
informational purposes. How can I find the name from the device object?

Is it safe to call IoGetDeviceObjectPointer() on every device I find in ,
\Device and \FileSystem?

Thanks,
Richard

>
> ----- Original Message -----
> From: “Richard Cartwright”
> To: “File Systems Developers”
> Sent: Thursday, May 22, 2003 17:05
> Subject: [ntfsd] How to find name of filesystem device in fs registration
> hook
>
>
> I use IoRegisterFsRegistrationChange() to hook FileSystem devices. My
> callback receives a device object pointer. I want to find out the name
> that these devices were created with (the name passed to IoCreateDevice)
> to show the user.
>
> How do I do this?
>
> My current way of handling this is to trawl the , \Device and \FileSystem
> directories of the object namespace (using ZwQueryDirectoryObject()) and
> open every device (using ZwOpenFile(), ObReferenceObjectByHandle(),
> IoGetRelatedDeviceObject()) to see whether its the device object I’m
> looking for.
>
> This normally works but some devices don’t like me opening them like this
> and the open call never returns.
>
> Is there a better way to do this?
> Can I use IoGetDeviceInterfaces() or something similar?
>
> Your suggestions would be greatly appreciated.
>
> Thanks,
> Richard Cartwright
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@spherical.com.au
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

> I use IoRegisterFsRegistrationChange() to hook FileSystem devices.
My

callback receives a device object pointer. I want to find out the
name
that these devices were created with (the name passed to
IoCreateDevice)
to show the user.

ObQueryNameString

Max

6

Thanks Maxim. ObQueryNameString() looks like what I’m after.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Friday, 23 May 2003 4:19 PM
To: File Systems Developers
Subject: [ntfsd] Re: How to find name of filesystem device in fs
registration hook

> I use IoRegisterFsRegistrationChange() to hook FileSystem devices.
My
> callback receives a device object pointer. I want to find out the
name
> that these devices were created with (the name passed to
IoCreateDevice)
> to show the user.

ObQueryNameString

Max

You are currently subscribed to ntfsd as: xxxxx@spherical.com.au
To unsubscribe send a blank email to xxxxx@lists.osr.com