how to get the filename or foldername

NTFSD
1

about rename delete file operation

if it is needed to get the name in the IRP_MJ_CREATE
or get the name in the “setinformation” irp.userbuffer or
irp.systembuffer

2

> about rename delete file operation

if it is needed to get the name in the IRP_MJ_CREATE
or get the name in the “setinformation” irp.userbuffer or
irp.systembuffer

there are 3 rename operation.
if (!pIrpStack->Parameters.SetFile.FileObject) //Simple Rename
{
KdPrint((“SimpleRename\n”));
status =
processSimpleRename(pDevObj,Irp,szSourceFileName,szTargetFileName);
}
else
{
if (renameInfo->RootDirectory == NULL) //Full Rename
{
KdPrint((“FullRename\n”));
status =
processFQRename(pDevObj,Irp,szSourceFileName,szTargetFileName);
}
else //Relative Rename
{
KdPrint((“RelativeRename\n”));
status =
processRelativeRename(pDevObj,Irp,szSourceFileName,szTargetFileName);
}
}

you need AssociatedIrp.SystemBuffer and source FileName(relative case)