How to get complete path of a file in IRP_MJ_CREATE?

NTFSD
1

Hi!

I meet with another problem! I want to get the complete path of the file to be
opened in the create_dispatch. I call the function ObQueryNameString to get the
name of
irpSp->FileObject. IFS document says when IRP_MJ_CREATE packet is sent, the
FileObject pointer points to the file object to be opened. But what I get by
calling this function is the name of the volume device object, like
\Device\Harddisk1\DP(1)0-0+8.
WHY?

If I want to get the complete path of the file to be opened, what should I do?By
the way, Sfilter also calls ObQueryNameString to get the file name!

2

I try to call this function ObQueryNameString with irpSp->FileObject, I get just the device name such as \Device\Harddisk1\DP(1)0-0+8. However, if I call that function with irpSp->FileObject->DeviceObject, I also the the same string as above.

And irpSp->FileObject->RelatedFileObject is always NULL. Why?

Help is needed!!!

3

First, Slava answered your question. Second, you should be working with
a mini-filter. Third, if you still don’t understand Slava’s answer,
read pages 176-177 in Najar’s book to start with.

If the RelatedFileObject is NULL, then there isn’t one. Look to
FileObject->FileName. And don’t call QueryNameString in precreate (where you
you should be looking for the name, the FileObject isn’t fully
initialized yet)

m.

headium2006@163.com wrote:

I try to call this function ObQueryNameString with irpSp->FileObject, I get just the device name such as \Device\Harddisk1\DP(1)0-0+8. However, if I call that function with irpSp->FileObject->DeviceObject, I also the the same string as above.

And irpSp->FileObject->RelatedFileObject is always NULL. Why?

Help is needed!!!

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com