How to rename files in kernel mode?

Hi All,

How I can rename files in kernel mode?

Thanks & Regards,
Amit.

>How I can rename files in kernel mode?

Read ZwSetInformationFile()'s documentation on MSDN - it answers your question…

Anton Bassov

We can rename file using ZwSetInformationFile with ‘FileShortNameInformation’ file information class parameter but MSDN states that file must be on NTFS volume.

I there any other class to do it.

Look at the description ( and restrictions ! ) of “ZwSetInformationFile”

C.

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Thursday, July 12, 2007 12:20 PM
Subject: [ntdev] How to rename files in kernel mode?

> Hi All,
>
> How I can rename files in kernel mode?
>
> Thanks & Regards,
> Amit.
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

xxxxx@yahoo.com wrote:

Hi All,

How I can rename files in kernel mode?

Thanks & Regards,
Amit.


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

ZwSetInformationFile().

Sometimes you actually have to look at the include files that define
these values. There you will find, right near FileShortNameInformation
FileRenameInformation and if you have the WDK you will find a
FILE_RENAME_INFORMATION structure that is used in conjunction with the
FileRenameInformation enumeration value. The search the OSR NtInsider
for the article some dinosaur wrote a long time ago about how to use
these values to rename a file in the kernel. Google is your friend.

Oh look, the msdn version of the WDK docs document all of this.
http://msdn2.microsoft.com/en-us/library/ms804363.aspx

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Thursday, July 12, 2007 6:37 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] How to rename files in kernel mode?

We can rename file using ZwSetInformationFile with
‘FileShortNameInformation’ file information class parameter but MSDN
states that file must be on NTFS volume.

I there any other class to do it.


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Thanks to all,

My problem is solved.

ZwSetInformationFile is failing because it requires the FILE_RENAME_INFORMATION aliened to 4 byte boundry.

> ZwSetInformationFile is failing because it requires the FILE_RENAME_INFORMATION

aliened to 4 byte boundry.

Actually, 4 -byte boundary is just a natural data alignment. Therefore, unless you intentionally pass a pointer to the location, aligned on WORD or BYTE boundary, as ‘FileInformation’ parameter to ZwSetInformationFile() , your FILE_RENAME_INFORMATION structure is guaranteed to be DWORD-aligned, no matter if you allocate it on the stack or dynamically with ExAllocatePool()…

Anton Bassov