How to rename file name in IRP_MJ_CREATE

NTFSD
1

Hi,

I am working on a Mini Filter, which change the name of the files originally requested with a different file name in the same folder for which we :

In Pre callback routine of IRP_MJ_CREATE: we replace the filename buffer of Data->Iopb->TargetFileObject->FileName, with the modified name, along with length and max length appropriately set, call FltSetCallbackDataDirty(Data); and return FLT_PREOP_SUCCESS_WITH_CALLBACK.

In the Post callback routine of IRP_MJ_CREATE: we replace back the filename buffer of Data->Iopb->TargetFileObject->FileName, with the original file name requested, and again call FltSetCallBackDirty.

The file gets opened / created and we are also able to save the contents of the file. But when we re-open the file and modify the contents, following things happen:

When saving the file: we get save as dialog box (tested on wordpad, mspaint).

Regards
Lokanadham R

2

Hi,

consider using STATUS_REPARSE

http://www.osronline.com/article.cfm?article=397

schrieb im Newsbeitrag news:xxxxx@ntfsd…
> Hi,
>
> I am working on a Mini Filter, which change the name of the files
> originally requested with a different file name in the same folder for
> which we :
>
> In Pre callback routine of IRP_MJ_CREATE: we replace the filename buffer
> of Data->Iopb->TargetFileObject->FileName, with the modified name, along
> with length and max length appropriately set, call
> FltSetCallbackDataDirty(Data); and return FLT_PREOP_SUCCESS_WITH_CALLBACK.
>
> In the Post callback routine of IRP_MJ_CREATE: we replace back the
> filename buffer of Data->Iopb->TargetFileObject->FileName, with the
> original file name requested, and again call FltSetCallBackDirty.
>
>
> The file gets opened / created and we are also able to save the contents
> of the file. But when we re-open the file and modify the contents,
> following things happen:
>
> When saving the file: we get save as dialog box (tested on wordpad,
> mspaint).
>
>
> Regards
> Lokanadham R
>

3

We did tried STATUS_REPARSE, but the create request failed with error code status_reparse.
The steps we followed:
replaced file name in Data->Iopb->TargetFileObject->FileName, with the modified name, along with length and max length appropriately set.
call FltSetCallbackDataDirty(Data);
set Data->Iopb->IoStatus.Status = STATUS_REPARSE;
set Data->Iopb->IoStatus.Information = IO_REPARSE.
and returned FLT_PREOP_COMPLETE.

are we doing anything wrong here. the IRP was never re-generated, and the FILE_SPY showed STATUS_REPARSE. Is there anything else to be done besides this. we are working on MiniFiters…

regards

4

> replaced file name in Data->Iopb->TargetFileObject->FileName, with the

modified name, along with length and max length appropriately set.

I think you forgot to add the device name( i.e. the name of the volume ).

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> We did tried STATUS_REPARSE, but the create request failed with error code
> status_reparse.
> The steps we followed:
> replaced file name in Data->Iopb->TargetFileObject->FileName, with the
> modified name, along with length and max length appropriately set.
> call FltSetCallbackDataDirty(Data);
> set Data->Iopb->IoStatus.Status = STATUS_REPARSE;
> set Data->Iopb->IoStatus.Information = IO_REPARSE.
> and returned FLT_PREOP_COMPLETE.
>
> are we doing anything wrong here. the IRP was never re-generated, and the
> FILE_SPY showed STATUS_REPARSE. Is there anything else to be done besides
> this. we are working on MiniFiters…
>
> regards
>

5

We are not changing device name, reason for that being the volume remains same, even theparent dir remains.
only the file name changes,still you do it…

regards

6

Is there any thing wrong in our first approach, the one which does not sets status_reparse in iostatus.status field. I am bit confused why Wordpad and MSPAInt show Save As dialog boxes, in those cases. even though we are handling Directory Browsing also …

7

Can any budy help me on how to implemet status_reparse in minifilters…

8

I am not familiar with mini filters but in legacy filter approach you would
have to set RelatedFileObject field in the FileObject to NULL along with
replacing the file name. I guess mini filter should also expose
RelatedFileObject one way or another.

Alexei.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@gmail.com
Sent: Friday, September 22, 2006 6:55 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] How to rename file name in IRP_MJ_CREATE

Is there any thing wrong in our first approach, the one which does not sets
status_reparse in iostatus.status field. I am bit confused why Wordpad and
MSPAInt show Save As dialog boxes, in those cases. even though we are
handling Directory Browsing also …

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@vmware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

Thanks Alexei,

I modified and set the RelatedFileObject to NULL for TargetFileObject, but still the same result, I will try to explain a bit more here.

The actual issue is not that the file does not gets created/opened, they do get created/opened,
But when we try to save the file in word pad and mspaint it shows save as dialog box ie… when I open a file from explorer in wordpad and edit it and then save it, it shows me save as dialog box,
As if the file has never existed, (in case of notepad this behavior is not there).

What I did observed is that after a successful IRP_MJ_CREATE word pad(I/O) Manager uses Fast I/O’s to get FIleBasicInformation and FileAllocationSize, Notepad does not perform such thing.

Here is the list of IRPs that I see in FileSpy issued by WordPad when it opens the file

IRP_MJ_CREATE for the document, (in this IRP i change the file name to a file which exists in the disk.)
FASTIO_QUERY_BASIC_INFO (I dont handle this).
FASTIO_QUERY_STANDARD_INFO (I don’t handle this).
FASTIO_READS
IRP_MJ_CLOSE returns STATUS_SUCCESS.

IN my current implementation I am not handling IRP_MJ_QUERY, does it needs to be handled ??

And when I hit Save button in word pad, surprisingly I don’t receive any IRP’s, wordpad some how comes to know that the file does not exists.
Has any budy also faced similar problem, is there something which we are missing in our implemenation, any other IRP which needs to be handled besids IRP_MJ_CREATE and IRP_MJ_DIRECTORY control (with minor irp for QueryDirectory).

I tested with disabling Fast I/O’s but same result. My question is how does wordpad/mspaint knows that the file does not exists.

Any help/reference would be greatly appreciated.

regards
Mohan

10

What do you do about query directory operations. MANY applications (but
not notepad) check for the existence of a file by looking for it in the
directory first.

The QueryNetworkOpen fast I/O call (the one that takes an IRP) is also a
create operation (logically it does a create, query information,
cleanup, and close in a single operation.) So if that fails (not return
FALSE but return name not found) the application would also believe the
target doesn’t exist.

The difficulty anyone on this forum is going to have is that you’re
asking us details from a VERY high level set of behaviors. Yes, I
realize it is frustrating because you see things at this very high
level, but bottom line what you need to do is compare the details of a
successful run (“what does this do on a normal drive” as seen by a
tracking tool like filespy, irptracker or filemon and then comparing it
to “what does this do on a drive where my filter is attached.”)

Your question has been phrases as “what am I doing wrong with the
reparse” so people are giving you feedback on how to properly implement
STATUS_REPARSE. But in fact, it sounds like your problem has nothing to
do with the reparse - if you can successfully open the file, then you’ve
implemented the reparse. Time to move on and look elsewhere.

It’s sort of like going to the doctor and asking him (or her) to look at
your foot. When you finally explain that it is because your elbow
hurts, the doctor might look beyond the foot…

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@rsystems.com
Sent: Saturday, September 23, 2006 7:29 AM
To: ntfsd redirect
Subject: RE:[ntfsd] How to rename file name in IRP_MJ_CREATE

Thanks Alexei,

I modified and set the RelatedFileObject to NULL for TargetFileObject,
but still the same result, I will try to explain a bit more here.

The actual issue is not that the file does not gets created/opened, they
do get created/opened,
But when we try to save the file in word pad and mspaint it shows save
as dialog box ie… when I open a file from explorer in wordpad and edit
it and then save it, it shows me save as dialog box,
As if the file has never existed, (in case of notepad this behavior is
not there).

What I did observed is that after a successful IRP_MJ_CREATE word
pad(I/O) Manager uses Fast I/O’s to get FIleBasicInformation and
FileAllocationSize, Notepad does not perform such thing.

Here is the list of IRPs that I see in FileSpy issued by WordPad when it
opens the file

IRP_MJ_CREATE for the document, (in this IRP i change the file name to a
file which exists in the disk.)
FASTIO_QUERY_BASIC_INFO (I dont handle this).
FASTIO_QUERY_STANDARD_INFO (I don’t handle this).
FASTIO_READS
IRP_MJ_CLOSE returns STATUS_SUCCESS.

IN my current implementation I am not handling IRP_MJ_QUERY, does it
needs to be handled ??

And when I hit Save button in word pad, surprisingly I don’t receive any
IRP’s, wordpad some how comes to know that the file does not exists.
Has any budy also faced similar problem, is there something which we are
missing in our implemenation, any other IRP which needs to be handled
besids IRP_MJ_CREATE and IRP_MJ_DIRECTORY control (with minor irp for
QueryDirectory).

I tested with disabling Fast I/O’s but same result. My question is how
does wordpad/mspaint knows that the file does not exists.

Any help/reference would be greatly appreciated.

regards
Mohan

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com