how to invoke simple rename

NTFSD
1

Hello,

is there any way how can I invoke simple rename from user mode? It is rename when FS filter driver sees RootDirectory = NULL, FileName is only the file name in FILE_RENAME_INFORMATION structure (it is rename of file inside a folder). I tried from cmd line using “rename” and “move” but still I get Fully Qualified Rename with absolute path in FileName of FILE_RENAME_INFORMATION. The same with explorer.

Thanks.

2

Write your own rename tool that calls NtSetInformationFile API. I think it’s
quite hard to find an app in user-mode which generates other two rename
operations but fully qualified rename. I think either simple rename or
relative rename can be simulated with network redirector. Have you read
“What’s in a name? - Cracking Rename Operations” arcticle in NT Insider?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@centrum.cz
Sent: Tuesday, July 03, 2012 7:09 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] how to invoke simple rename

Hello,

is there any way how can I invoke simple rename from user mode? It is rename
when FS filter driver sees RootDirectory = NULL, FileName is only the file
name in FILE_RENAME_INFORMATION structure (it is rename of file inside a
folder). I tried from cmd line using “rename” and “move” but still I get
Fully Qualified Rename with absolute path in FileName of
FILE_RENAME_INFORMATION. The same with explorer.

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

> Write your own rename tool that calls NtSetInformationFile API. I think it’s quite hard

to find an app in user-mode which generates other two rename

You can also use FileTest for that. Filetest is capable of firing almost every NtSetInformationFile that it out there.

4

> You can also use FileTest for that. Filetest is capable of firing almost every NtSetInformationFile that it out there.

Ok I used version from osronline and that didn’t have NtSetInformationFile. I downloaded new one from another web site and it works fine.

And is it possible to invoke also “relative rename” with RootDirectory non NULL via Filetest? It means to open destination folder, get the handle, put it to RootDirectory of FILE_RENAME_INFORMATION and open source file, then call NtSetInformationFile. I tried to open folder and also file in parallel, but as soon as I do 2nd open, first handle is closed by FileTest. 2nd problem is if I put handle value to RootDirectory, then its value is reset back to 0000000000000000 and status is “The entered value has bad format.”

5

> And is it possible to invoke also “relative rename” with RootDirectory

non NULL via Filetest? It means to open destination folder, get the

No, the current version does not support editing the root
directory. I’ll think of some comfortable way to add it there
when I’ll have time.

L.

6

> And is it possible to invoke also “relative rename” with RootDirectory non NULL via Filetest?

I made a new build, 2.1.0.345, which is capable of calling relative rename. You edit the “RootDirectory” item (F2 or mouse click) and you enter a directory name. FileTest will open it and put the handle value into the tree item. When you fire the NtSetInformationFile, it will do the relative rename.

Get it here: http://www.zezula.net/fstools.html

The directory handle itself is closed when you either enter another directory or you exit FileTest.

L.