In Win32 APP, how to obtain the full path file name from it's handle

OSR_Community_User · March 29, 2004, 1:12am

Hello everybody, I hooked some file system APIs, such as WriteFile, ReadFile, etc. I replaced WriteFile API with MyWriteFile, and in MyWriteFile function, I want to get the file name via the inputting file handle, I searched from google and find the code like below from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/obtaining_a_file_name_from_a_file_handle.asp

BOOL GetFilenameFromHandle(HANDLE hFile)
{
BOOL bSuccess = FALSE;
TCHAR* pszFilename[MAX_PATH+1];
uint uMaxLenDest = 0;

// Get the file size.
DWORD dwFileSizeHi = 0;
DWORD dwFileSizeLo = GetFileSize(hFile, &dwFileSizeHi);

// Create a file mapping object.
HANDLE hFileMap = CreateFileMapping(hFile,
NULL,
PAGE_READONLY,
0,
dwFileSizeLo,
NULL);

if (hFileMap) {
// Create a file mapping to get the file name.
void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);

if (pMem) {
if (GetMappedFileName (GetCurrentProcess(),
pMem,
pszFilename,
MAX_PATH)) {

// Attempt to translate the path with device name into drive
// letters.
TCHAR szTemp[512];
*szTemp = NULL;

if (GetLogicalDriveStrings(MAX_ARRAY_ITEMS(szTemp)-1,
szTemp)) {
TCHAR szName[MAX_PATH];
TCHAR szDrive[3] = TEXT(" :");
BOOL bFound = FALSE;
TCHAR* p = szTemp;

do {
// Copy the drive letter into the template string,
// removing the backslash.
*szDrive = *p;

// Look up each device name.
if (QueryDosDevice(szDrive, szName,
MAX_ARRAY_ITEMS(szName))) {
uint uNameLen = _tcslen(szName);

// If greater than file name length, it’s not a match.
if (uNameLen < uMaxLenDest) {
bFound = _tcsnicmp(pszFilename, szName, uNameLen)
== 0;

if (bFound) {
// Reconstruct pszFilename using szTemp as scratch,
// and replace device path with our DOS path.
TCHAR szTempFile[MAX_PATH];
_stprintf(szTempFile,
TEXT(“%s%s”),
szDrive,
pszFilename+uNameLen);
stringCopy(pszFilename, szTempFile, uMaxLenDest);
}
}
}

// Go to the next NULL character.
while (*p++);
} while (!bFound && *p); // at the end of the string
}
}
bSuccess = TRUE;
if (!UnmapViewOfFile(pMem)) assert(0);
}

if (!CloseHandle(hFileMap)) assert(0);
}
return(bSuccess);
}

I modified some errors and put the code into my project, it do the work when I try to debug it, however, because MyWriteFile is in DLL, I must inject my dll into the target process to take effect my WriteFile API. when I inject my dll into some specified process, the CreateFileMapping failed, GetLastError() returned 161, I looked it up in MSDN, and find that it indicates that "The specified path is invalid. ", I dont’ understand what happened, so who can help me ?

Thanks a lot.

OSR_Community_User · March 30, 2004, 12:43am

Can anybody tell me why ? how can I resolve it ?

Tom_lyd

OSR_Community_User · March 30, 2004, 3:32am

GetModuleFileName()
GetModuleFileNameEx()

Regards,
Yan.

-----Original Message-----
From: lists.osr.com [mailto:Tom_lyd@163.com]
Sent: Tuesday, March 30, 2004 7:42 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] In Win32 APP, how to obtain the full path file name
from it’s handle

Can anybody tell me why ? how can I resolve it ?

Tom_lyd

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@smlink.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · March 30, 2004, 3:58am

GetModuleFileName(Ex) obtain the module’s file name, I want to get the file name, not module name.
for example, some one called :
HANDLE hFile = ::CreateFile( “C:\temp\test.txt”, GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );

and then he call WriteFile to write some data to test.txt file, because I hooked the WriteFile API, so MyWriteFile will be called instead of the origional WriteFile API, and in myWirteFile API, I know the handle to the file into which the caller want to write some data, but I donn’t know the file name, so I want to get the specified file fullpath name from the handle, but I haven’t found a good way, what should I do ?

OSR_Community_User · March 30, 2004, 7:43pm

GetModuleFileName(Ex) obtain the module’s file name, I want to get the file
name, not module name.
for example, some one called :
HANDLE hFile = ::CreateFile( “C:\temp\test.txt”, GENERIC_READ |
GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );

and then he call WriteFile to write some data to test.txt file, because I
hooked the WriteFile API, so MyWriteFile will be called instead of the
origional WriteFile API, and in myWirteFile API, I know the handle to the
file into which the caller want to write some data, but I donn’t know the
file name, so I want to get the specified file fullpath name from the
handle, but I haven’t found a good way, what should I do ?

Alexei_Jelvis-2 · March 30, 2004, 8:38pm

First of all I want to point out that the standard way of intercepting IO is
file system Filter driver and not hooking API. There are standard ways to
get the file name in a filter driver.
As to your original question I don’t know any Win32 API to achieve this. You
may use native API NtQueryInformationFile with FileInformationClass ==
FileNameInformation or you may hook CreateFile as well as WriteFile and
maintain a lookup table that allows to resolve file name from a handle.

Alexei.

“Tom_lyd” <tom_lyd> wrote in message news:xxxxx@ntdev…
> GetModuleFileName(Ex) obtain the module’s file name, I want to get the
file name, not module name.
> for example, some one called :
> HANDLE hFile = ::CreateFile( “C:\temp\test.txt”, GENERIC_READ |
GENERIC_WRITE,
> FILE_SHARE_READ | FILE_SHARE_WRITE,
> NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );
>
> and then he call WriteFile to write some data to test.txt file, because I
hooked the WriteFile API, so MyWriteFile will be called instead of the
origional WriteFile API, and in myWirteFile API, I know the handle to the
file into which the caller want to write some data, but I donn’t know the
file name, so I want to get the specified file fullpath name from the
handle, but I haven’t found a good way, what should I do ?
>
>
></tom_lyd>

OSR_Community_User · March 31, 2004, 1:24am

Thanks for your answer at first. Just as you say, in fact, I have already
hooked CreateFileA/W and WriteFile as well, but the target process called
CreateFileA/W before I succeeded injecting my hook dll into it’s address
space, so my createfile api can not be called when the target process call
createfile too early.

In the other hand, I know the best way is to implement a fils system filter
driver, but my project must run on both 9x and NT/2k, I don’t want to write
a Vxd as well a WDM driver, by the other way, it’s something difficult to
debug an IFS driver, so I must resolve my problem.

Thank you.

OSR_Community_User · March 31, 2004, 2:04am

Alexei Jelvis:
I have tried the way you told me like this:

typedef struct _FILE_NAME_INFORMATION {
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;

typedef ULONG ( NTAPI * PFNNTQUERYINFOFILE)( HANDLE, PIO_STATUS_BLOCK,
PVOID, ULONG, FILE_INFORMATION_CLASS );

IO_STATUS_BLOCK io;
FILE_NAME_INFORMATION * pFni = (PFILE_NAME_INFORMATION)new char[MAX_PATH];
HMODULE hNtDll = ::LoadLibrary( “NTDLL.dll” );
if( hNtDll )
{
PFNNTQUERYINFOFILE lpfnQueryInfoFile =
(PFNNTQUERYINFOFILE)::GetProcAddress( hNtDll, “NtQueryInformationFile” );

if( lpfnQueryInfoFile )
(* lpfnQueryInfoFile)( hFile, &io, pFni, 250, FileNameInformation );
}

In this way, I succeeded in calling NtQueryInformationFile, however, the
FilName field in FILE_NAME_INFORMATION, returned by NtQueryInformationFile,
contain only string exclude t he root directory. In fact, I create a file
named “C:\temp\temp\test.txt”, but the returned content is
“\temp\temp\test.txt”, how can I get the logical driver as well ?

Thanks a lot.

Ray_Trent · March 31, 2004, 7:07pm

Dare I ask what it is that you’re trying accomplish here? There might be
a better solution…

lists.osr.com wrote:

Thanks for your answer at first. Just as you say, in fact, I have already
hooked CreateFileA/W and WriteFile as well, but the target process called
CreateFileA/W before I succeeded injecting my hook dll into it’s address
space, so my createfile api can not be called when the target process call
createfile too early.

In the other hand, I know the best way is to implement a fils system filter
driver, but my project must run on both 9x and NT/2k, I don’t want to write
a Vxd as well a WDM driver, by the other way, it’s something difficult to
debug an IFS driver, so I must resolve my problem.

Thank you.

–
…/ray..

OSR_Community_User · March 31, 2004, 8:10pm

It’s obvisiously in my title, I want to get full path filename from file
hane in win32 application, not kernel mode.
My program is a hook project, I hooked file associated APIs, such
CcreateFileA, CreateFileW, WriteFile and so on, I create a look up table, in
which the file name and it’s opened handle were stored, however, the targer
process maybe has already called CreateFileA/W to opened the specified file
before my hook process succeeded in injecting into it’s address space, so
MyCreateFileA/W can not be called, and I can not create the map relationship
between file name with the handle in lookup table. Later on, in MyWriteFile,
the input parameter tells me only file handle, in order to check whether the
file handle is associated with the specified file, I must try to get it’s
full path name, I searched from google, and found the code below:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base
/obtaining_a_file_name_from_a_file_handle.asp
BOOL GetFilenameFromHandle(HANDLE hFile)
{
BOOL bSuccess = FALSE;
TCHAR* pszFilename[MAX_PATH+1];
uint uMaxLenDest = 0;