How to get the network file path in Vista?

NTFSD
1

Hi!

I was trying to modify the filespy sample to get the network file path of the sort
\Device\LanmanRedirector.… instead of \Device\Mup.… in Windows Vista.

All that i could find by googling was that FsRtlMupGetProviderInfoFromFileObject should be used to get the name from the File object.

But this function is not documented in the WDK documentation.
I found its declaration in ntifs.h.

However, whenever i am trying to query the name by this funtion, it is returning 0xC0000034.

Has anyone used this function?

Is it correct to use it in the IRP_MJ_CREATE dispatch routine?
If not, then how should i build up a path of sort \Device\LanmanRedirector.… in Vista in IRP_MJ_CREATE dispatch routine?

Thanks,
Ayush Gupta

2

Note that the architecture of MUP and redirectors was changed in Vista. Now MUP register itself as a filesystem and network redirector device is only symbolic link to mup device. All network providers, which register by FsRtlRegisterUncProviderEx(), have in the fact only one (MUP) device. Note that the (3rd party) legacy network providers can still use special device, but must register by the old API. It seems you need “deparse” to the symbolic link.

e.g. \device\LanmanRedirector -> \device\mup;LanmanRedirector

It looks like you should be looking for some Object Manager API, but I am in doubt that there is any.

I think you can use ??\UNC\Server\Share\Path convention. The ??\UNC is a symlink to \Device\Mup, so \Device\Mup\Server\Share\Path should work also, but I think the first one is even documented.

-bg

For more details google for “Mup Changes in Microsoft Windows Vista”.

3

> network redirector device is only symbolic link to mup device

Let me clarify this statement. Network redirector device (known as CDO) is unnamed in the fact. It is known only to MUP. MUP gets it by func. FsRtlRegisterUncProviderEx() where it also gets name of the named device, which is not real device but link to MUP device. MUP takes responsibility for creation of this link.

I hope it is not even more confusing.
-bg

4

Note that the architecture of MUP and redirectors was changed in Vista. Now MUP register itself as a filesystem and network redirector device is only symbolic link to mup device. All network providers, which register by FsRtlRegisterUncProviderEx(), have in the fact only one (MUP) device. Note that the (3rd party) legacy network providers can still use special device, but must register by the old API. It seems you need “deparse” to the symbolic link.

e.g. \device\LanmanRedirector -> \device\mup;LanmanRedirector

It looks like you should be looking for some Object Manager API, but I am in doubt that there is any.

I think you can use ??\UNC\Server\Share\Path convention. The ??\UNC is a symlink to \Device\Mup, so \Device\Mup\Server\Share\Path should work also, but I think the first one is even documented.

Not at all related with the query. I did not ask about the functionality of MUP.
The aim is to IDENTIFY the provider.
I had asked about the usage of FsRtlMupGetProviderInfoFromFileObject. :slight_smile:

Regards,
Ayush Gupta

5

Excuse me in such case. It seemed to me that your goal is a little bit strange like it was a result of incompehention how it works on vista.

-bg