IRJ_MJ_SET_INFORMATION related query

Hi,

I am trying to rename the file when it is getting deleted. So in my dispatch routine for IRP_MJ_SET_INFORMATION when i receive FileDisposition information i create my own IRP with major function IRP_MJ_SET_INFORMATION for FileRenameInformation and pass it to the next driver. But i am always getting C0000033 error.
Here is the code for the funtions,
DWORD HoldFileBack( PDEVICE_OBJECT next_device, PFILE_OBJECT file_obj )
{
PFILE_RENAME_INFORMATION link_info = NULL;
NTSTATUS status;

//allocate memory for link_info
link_info = ExAllocatePool( NonPagedPool, sizeof( FILE_RENAME_INFORMATION )

  • MAX_FILENAME_LENGTH );
    if( NULL == link_info )
    {
    DbgPrint( “No memory for Link_info\n” );
    return 1;
    }

memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION ) + MAX_FILENAME_LENGTH );

//create link filename
wcscpy( link_info->FileName, L"\??\C:\hlink\0.tmp" );
link_info->FileNameLength = wcslen( link_info->FileName ) * 2;

//now pass the rename irp down
status = SetFileInfo( next_device, file_obj, NULL, link_info,
sizeof( FILE_RENAME_INFORMATION ) + link_info->FileNameLength,
FileRenameInformation, NULL );
if( status != STATUS_SUCCESS )
{
DbgPrint( “rename Failed\n” );
ExFreePool( link_info );
return 1;
}
ExFreePool( link_info );

return 0;
}

//----------------------------------------------------------------------
//
// SetFileInfoComplete
//
// This routine is used to handle I/O completion for our self-generated
// IRP that is used to set file information.
//
//----------------------------------------------------------------------
NTSTATUS SetFileInfoComplete(IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp,
IN PKEVENT SynchronizingEvent
)
{
DeviceObject;
// Copy the status information back into the “user” IOSB.
ASSERT( NULL != Irp->UserIosb );
*Irp->UserIosb = Irp->IoStatus;
// Set the user event - wakes up the mainline code doing this.
KeSetEvent(SynchronizingEvent, IO_NO_INCREMENT, FALSE);
// Free the IRP now that we are done with it.
IoFreeIrp(Irp);
// We return STATUS_MORE_PROCESSING_REQUIRED because this “magic” return value
// tells the I/O Manager that additional processing will be done by this driver
// to the IRP - in fact, it might (as it is in this case) already BE done - and
// the IRP cannot be completed.
return STATUS_MORE_PROCESSING_REQUIRED;
}

//----------------------------------------------------------------------
//
// SetFileInfo
//
// This function sets file information.
//
//----------------------------------------------------------------------
NTSTATUS SetFileInfo(IN PDEVICE_OBJECT next_device_object,
IN PFILE_OBJECT file_object,
PFILE_OBJECT trg_file_object,
OUT PVOID file_information,
IN ULONG length,
IN FILE_INFORMATION_CLASS file_information_class,
OUT PULONG length_returned OPTIONAL
)
{
PIRP irp;
KEVENT event;
IO_STATUS_BLOCK io_status_block;
PIO_STACK_LOCATION io_stack_location;
NTSTATUS status;

length_returned;
//Initialize the event
KeInitializeEvent(&event, SynchronizationEvent, FALSE);
io_status_block.Status = STATUS_SUCCESS;
io_status_block.Information = 0;

//Allocate an irp for this request.
irp = IoAllocateIrp(next_device_object->StackSize, FALSE);
if(!irp)
{
DbgPrint(“Unable to allocate irp %d\n”,LINE);
return FALSE;
}

//Build the irp’s main body
irp->Tail.Overlay.Thread = PsGetCurrentThread();
irp->RequestorMode = KernelMode;
irp->UserIosb = &io_status_block;
irp->UserEvent = NULL;
irp->Flags = IRP_SYNCHRONOUS_API;

//Set up the I/O stack location.
io_stack_location = IoGetNextIrpStackLocation(irp);
io_stack_location->MajorFunction = IRP_MJ_SET_INFORMATION;
io_stack_location->FileObject = file_object;
irp->AssociatedIrp.SystemBuffer = file_information;
io_stack_location->Parameters.SetFile.Length = length;
io_stack_location->Parameters.SetFile.FileInformationClass = file_information_class; //FileInternalInformation;
io_stack_location->Parameters.SetFile.FileObject = trg_file_object;

// Set the completion routine.
IoSetCompletionRoutine(irp, SetFileInfoComplete,
&event, TRUE, TRUE, TRUE);

//Send it to the FSD
status = IoCallDriver(next_device_object, irp);

if (STATUS_PENDING == status)
{
//Wait for the I/O
KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);
}
return io_status_block.Status;
}

Can anybody please point out what i am doing wrong with filename?

Thanks,
Rahul

The error is here
wcscpy( link_info->FileName, L"\??\C:\hlink\0.tmp" );

You must provide the name from the FSD’s namespace. The FSD extends the
namespace, L"\??\C:" is a volume name ( actually the symbolic link ), and
FSD must parse the remainder, i.e. “\hlink\0.tmp”. Also you do not provide
the new target file object (i.e. SetFile.FileObject), so the FSD may
consider this operation as a simple rename( i.e. relative to the source
file’s parent directory ).

The error is here
wcscpy( link_info->FileName, L"\??\C:\hlink\0.tmp" );

You must provide the name from the FSD’s namespace. The FSD extends the
namespace, L"\??\C:" is a volume name ( actually the symbolic link ), and
FSD must parse the remainder, i.e. “\hlink\0.tmp”. Also you do not provide
the new target file object (i.e. SetFile.FileObject), so the FSD may
consider this operation as a simple rename( i.e. relative to the source
file’s parent directory ).

wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I am trying to rename the file when it is getting deleted. So in my
> dispatch routine for IRP_MJ_SET_INFORMATION when i receive FileDisposition
> information i create my own IRP with major function IRP_MJ_SET_INFORMATION
> for FileRenameInformation and pass it to the next driver. But i am always
> getting C0000033 error.
> Here is the code for the funtions,
> DWORD HoldFileBack( PDEVICE_OBJECT next_device, PFILE_OBJECT file_obj )
> {
> PFILE_RENAME_INFORMATION link_info = NULL;
> NTSTATUS status;
>
> //allocate memory for link_info
> link_info = ExAllocatePool( NonPagedPool, sizeof(
> FILE_RENAME_INFORMATION )
> + MAX_FILENAME_LENGTH );
> if( NULL == link_info )
> {
> DbgPrint( “No memory for Link_info\n” );
> return 1;
> }
>
> memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION ) +
> MAX_FILENAME_LENGTH );
>
> //create link filename
> wcscpy( link_info->FileName, L"\??\C:\hlink\0.tmp" );
> link_info->FileNameLength = wcslen( link_info->FileName ) * 2;
>
> //now pass the rename irp down
> status = SetFileInfo( next_device, file_obj, NULL, link_info,
> sizeof( FILE_RENAME_INFORMATION ) + link_info->FileNameLength,
> FileRenameInformation, NULL );
> if( status != STATUS_SUCCESS )
> {
> DbgPrint( “rename Failed\n” );
> ExFreePool( link_info );
> return 1;
> }
> ExFreePool( link_info );
>
> return 0;
> }
>
> //----------------------------------------------------------------------
> //
> // SetFileInfoComplete
> //
> // This routine is used to handle I/O completion for our self-generated
> // IRP that is used to set file information.
> //
> //----------------------------------------------------------------------
> NTSTATUS SetFileInfoComplete(IN PDEVICE_OBJECT DeviceObject,
> IN PIRP Irp,
> IN PKEVENT SynchronizingEvent
> )
> {
> DeviceObject;
> // Copy the status information back into the “user” IOSB.
> ASSERT( NULL != Irp->UserIosb );
> *Irp->UserIosb = Irp->IoStatus;
> // Set the user event - wakes up the mainline code doing this.
> KeSetEvent(SynchronizingEvent, IO_NO_INCREMENT, FALSE);
> // Free the IRP now that we are done with it.
> IoFreeIrp(Irp);
> // We return STATUS_MORE_PROCESSING_REQUIRED because this “magic” return
> value
> // tells the I/O Manager that additional processing will be done by this
> driver
> // to the IRP - in fact, it might (as it is in this case) already BE
> done - and
> // the IRP cannot be completed.
> return STATUS_MORE_PROCESSING_REQUIRED;
> }
>
> //----------------------------------------------------------------------
> //
> // SetFileInfo
> //
> // This function sets file information.
> //
> //----------------------------------------------------------------------
> NTSTATUS SetFileInfo(IN PDEVICE_OBJECT next_device_object,
> IN PFILE_OBJECT file_object,
> PFILE_OBJECT trg_file_object,
> OUT PVOID file_information,
> IN ULONG length,
> IN FILE_INFORMATION_CLASS file_information_class,
> OUT PULONG length_returned OPTIONAL
> )
> {
> PIRP irp;
> KEVENT event;
> IO_STATUS_BLOCK io_status_block;
> PIO_STACK_LOCATION io_stack_location;
> NTSTATUS status;
>
> length_returned;
> //Initialize the event
> KeInitializeEvent(&event, SynchronizationEvent, FALSE);
> io_status_block.Status = STATUS_SUCCESS;
> io_status_block.Information = 0;
>
> //Allocate an irp for this request.
> irp = IoAllocateIrp(next_device_object->StackSize, FALSE);
> if(!irp)
> {
> DbgPrint(“Unable to allocate irp %d\n”, LINE );
> return FALSE;
> }
>
> //Build the irp’s main body
> irp->Tail.Overlay.Thread = PsGetCurrentThread();
> irp->RequestorMode = KernelMode;
> irp->UserIosb = &io_status_block;
> irp->UserEvent = NULL;
> irp->Flags = IRP_SYNCHRONOUS_API;
>
> //Set up the I/O stack location.
> io_stack_location = IoGetNextIrpStackLocation(irp);
> io_stack_location->MajorFunction = IRP_MJ_SET_INFORMATION;
> io_stack_location->FileObject = file_object;
> irp->AssociatedIrp.SystemBuffer = file_information;
> io_stack_location->Parameters.SetFile.Length = length;
> io_stack_location->Parameters.SetFile.FileInformationClass =
> file_information_class; //FileInternalInformation;
> io_stack_location->Parameters.SetFile.FileObject = trg_file_object;
>
> // Set the completion routine.
> IoSetCompletionRoutine(irp, SetFileInfoComplete,
> &event, TRUE, TRUE, TRUE);
>
> //Send it to the FSD
> status = IoCallDriver(next_device_object, irp);
>
> if (STATUS_PENDING == status)
> {
> //Wait for the I/O
> KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);
> }
> return io_status_block.Status;
> }
>
> Can anybody please point out what i am doing wrong with filename?
>
> Thanks,
> Rahul
>

> The error is here

wcscpy( link_info->FileName,
L"\??\C:\hlink\0.tmp" );

You must provide the name from the FSD’s namespace.
The FSD extends the
namespace, L"\??\C:" is a volume name ( actually
the symbolic link ), and
FSD must parse the remainder, i.e. “\hlink\0.tmp”.
So can u please tell wht is the current name? because
i have seen same kind of name passed in the
FileRenameInformation in the IRP_SET_INFROMATION
dispatch routine.

Also you do not provide
the new target file object (i.e.
SetFile.FileObject), so the FSD may
consider this operation as a simple rename( i.e.
relative to the source
file’s parent directory ).

Actually SetFile.FileObject is set to NULL as
trg_file_object is passed as NULL.

thanks,
Rahul


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

This request must contain the valid Parameters.SetFile.FileObject, this
FileObject is created by the system which calls IoCreateFile(
FILE_RENAME_INFORMATION->FileName ). The FSD uses
Parameters.SetFile.FileObject instead the fully qualified file name. If
Parameters.SetFile.FileObject is NULL then this is a relative rename.

“rahul naik” wrote in message news:xxxxx@ntfsd…
>> The error is here
>> wcscpy( link_info->FileName,
>> L"\??\C:\hlink\0.tmp" );
>>
>> You must provide the name from the FSD’s namespace.
>> The FSD extends the
>> namespace, L"\??\C:" is a volume name ( actually
>> the symbolic link ), and
>> FSD must parse the remainder, i.e. “\hlink\0.tmp”.
> So can u please tell wht is the current name? because
> i have seen same kind of name passed in the
> FileRenameInformation in the IRP_SET_INFROMATION
> dispatch routine.
>
>> Also you do not provide
>> the new target file object (i.e.
>> SetFile.FileObject), so the FSD may
>> consider this operation as a simple rename( i.e.
>> relative to the source
>> file’s parent directory ).
>>
> Actually SetFile.FileObject is set to NULL as
> trg_file_object is passed as NULL.
>
> thanks,
> Rahul
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

Hi,

i made changes as per ur suggestion but i m still
getting error c0000033.

i also tried with RootDirectory field in
FILE_RENAME_INFORMATION structure but it renames the
file into source directory instead of target
directory. I am passing handle of target directory in
link_info->RootDirectory and link_info->FileName as
“0.tmp”

DWORD HoldFileBack( PDEVICE_OBJECT next_device,
PFILE_OBJECT file_obj )
{
PFILE_RENAME_INFORMATION link_info = NULL;
NTSTATUS status;
UNICODE_STRING obj_name;
OBJECT_ATTRIBUTES object;
IO_STATUS_BLOCK io_status;
HANDLE trg_dir_handle;
PFILE_OBJECT trg_file_obj;

//allocate memory for link_info
link_info = ExAllocatePool( NonPagedPool, sizeof(
FILE_RENAME_INFORMATION )

  • MAX_FILENAME_LENGTH );
    if( NULL == link_info )
    {
    DbgPrint( “No memory for Link_info\n” );
    return 1;
    }

memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION
) + MAX_FILENAME_LENGTH );

//create link filename
wcscpy( link_info->FileName, L"\??\C:\hlink" );
RtlInitUnicodeString( &obj_name, link_info->FileName
);

InitializeObjectAttributes(&object,&obj_name,OBJ_KERNEL_HANDLE
,NULL,NULL);
status = ZwCreateFile( &trg_dir_handle,
GENERIC_WRITE, &object, &io_status, NULL, 0,
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
FILE_DIRECTORY_FILE,
NULL, 0 );
if ( status != STATUS_SUCCESS )
{
DbgPrint( “Error Opening target directory\n” );
return 1;
}

status = ObReferenceObjectByHandle( trg_dir_handle,
GENERIC_WRITE, NULL,
KernelMode, (PVOID*)&trg_file_obj,
NULL );
if ( status != STATUS_SUCCESS )
{
DbgPrint( “Error Opening target directory\n” );
ZwClose( trg_dir_handle );
return 1;
}

wcscpy( link_info->FileName,
L"\??\C:\hlink\0.tmp" );
link_info->FileNameLength = wcslen(
link_info->FileName ) * 2;

//now pass the rename irp down
status = SetFileInfo( next_device, file_obj,
trg_file_obj, link_info,
sizeof( FILE_RENAME_INFORMATION ) +
link_info->FileNameLength,
FileRenameInformation, NULL );
if( status != STATUS_SUCCESS )
{
DbgPrint( “rename Failed\n” );
ExFreePool( link_info );
return 1;
}
ExFreePool( link_info );

return 0;
}

— Slava Imameyev wrote:

> This request must contain the valid
> Parameters.SetFile.FileObject, this
> FileObject is created by the system which calls
> IoCreateFile(
> FILE_RENAME_INFORMATION->FileName ). The FSD uses
> Parameters.SetFile.FileObject instead the fully
> qualified file name. If
> Parameters.SetFile.FileObject is NULL then this is a
> relative rename.

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

The source file and the target file must be from the same volume.

“rahul naik” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> i made changes as per ur suggestion but i m still
> getting error c0000033.
>
> i also tried with RootDirectory field in
> FILE_RENAME_INFORMATION structure but it renames the
> file into source directory instead of target
> directory. I am passing handle of target directory in
> link_info->RootDirectory and link_info->FileName as
> “0.tmp”
>
> DWORD HoldFileBack( PDEVICE_OBJECT next_device,
> PFILE_OBJECT file_obj )
> {
> PFILE_RENAME_INFORMATION link_info = NULL;
> NTSTATUS status;
> UNICODE_STRING obj_name;
> OBJECT_ATTRIBUTES object;
> IO_STATUS_BLOCK io_status;
> HANDLE trg_dir_handle;
> PFILE_OBJECT trg_file_obj;
>
> //allocate memory for link_info
> link_info = ExAllocatePool( NonPagedPool, sizeof(
> FILE_RENAME_INFORMATION )
> + MAX_FILENAME_LENGTH );
> if( NULL == link_info )
> {
> DbgPrint( “No memory for Link_info\n” );
> return 1;
> }
>
> memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION
> ) + MAX_FILENAME_LENGTH );
>
> //create link filename
> wcscpy( link_info->FileName, L"\??\C:\hlink" );
> RtlInitUnicodeString( &obj_name, link_info->FileName
> );
>
> InitializeObjectAttributes(&object,&obj_name,OBJ_KERNEL_HANDLE
> ,NULL,NULL);
> status = ZwCreateFile( &trg_dir_handle,
> GENERIC_WRITE, &object, &io_status, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
> FILE_DIRECTORY_FILE,
> NULL, 0 );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> return 1;
> }
>
> status = ObReferenceObjectByHandle( trg_dir_handle,
> GENERIC_WRITE, NULL,
> KernelMode, (PVOID*)&trg_file_obj,
> NULL );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> ZwClose( trg_dir_handle );
> return 1;
> }
>
> wcscpy( link_info->FileName,
> L"\??\C:\hlink\0.tmp" );
> link_info->FileNameLength = wcslen(
> link_info->FileName ) * 2;
>
> //now pass the rename irp down
> status = SetFileInfo( next_device, file_obj,
> trg_file_obj, link_info,
> sizeof( FILE_RENAME_INFORMATION ) +
> link_info->FileNameLength,
> FileRenameInformation, NULL );
> if( status != STATUS_SUCCESS )
> {
> DbgPrint( “rename Failed\n” );
> ExFreePool( link_info );
> return 1;
> }
> ExFreePool( link_info );
>
> return 0;
> }
>
> — Slava Imameyev wrote:
>
>> This request must contain the valid
>> Parameters.SetFile.FileObject, this
>> FileObject is created by the system which calls
>> IoCreateFile(
>> FILE_RENAME_INFORMATION->FileName ). The FSD uses
>> Parameters.SetFile.FileObject instead the fully
>> qualified file name. If
>> Parameters.SetFile.FileObject is NULL then this is a
>> relative rename.
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

You must open the target directory for the target file! That is
IO_OPEN_TARGET_DIRECTORY flag must be set. The FSD opens the directory
instead the file and will use it in rename operation processing.

“rahul naik” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> i made changes as per ur suggestion but i m still
> getting error c0000033.
>
> i also tried with RootDirectory field in
> FILE_RENAME_INFORMATION structure but it renames the
> file into source directory instead of target
> directory. I am passing handle of target directory in
> link_info->RootDirectory and link_info->FileName as
> “0.tmp”
>
> DWORD HoldFileBack( PDEVICE_OBJECT next_device,
> PFILE_OBJECT file_obj )
> {
> PFILE_RENAME_INFORMATION link_info = NULL;
> NTSTATUS status;
> UNICODE_STRING obj_name;
> OBJECT_ATTRIBUTES object;
> IO_STATUS_BLOCK io_status;
> HANDLE trg_dir_handle;
> PFILE_OBJECT trg_file_obj;
>
> //allocate memory for link_info
> link_info = ExAllocatePool( NonPagedPool, sizeof(
> FILE_RENAME_INFORMATION )
> + MAX_FILENAME_LENGTH );
> if( NULL == link_info )
> {
> DbgPrint( “No memory for Link_info\n” );
> return 1;
> }
>
> memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION
> ) + MAX_FILENAME_LENGTH );
>
> //create link filename
> wcscpy( link_info->FileName, L"\??\C:\hlink" );
> RtlInitUnicodeString( &obj_name, link_info->FileName
> );
>
> InitializeObjectAttributes(&object,&obj_name,OBJ_KERNEL_HANDLE
> ,NULL,NULL);
> status = ZwCreateFile( &trg_dir_handle,
> GENERIC_WRITE, &object, &io_status, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
> FILE_DIRECTORY_FILE,
> NULL, 0 );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> return 1;
> }
>
> status = ObReferenceObjectByHandle( trg_dir_handle,
> GENERIC_WRITE, NULL,
> KernelMode, (PVOID*)&trg_file_obj,
> NULL );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> ZwClose( trg_dir_handle );
> return 1;
> }
>
> wcscpy( link_info->FileName,
> L"\??\C:\hlink\0.tmp" );
> link_info->FileNameLength = wcslen(
> link_info->FileName ) * 2;
>
> //now pass the rename irp down
> status = SetFileInfo( next_device, file_obj,
> trg_file_obj, link_info,
> sizeof( FILE_RENAME_INFORMATION ) +
> link_info->FileNameLength,
> FileRenameInformation, NULL );
> if( status != STATUS_SUCCESS )
> {
> DbgPrint( “rename Failed\n” );
> ExFreePool( link_info );
> return 1;
> }
> ExFreePool( link_info );
>
> return 0;
> }
>
> — Slava Imameyev wrote:
>
>> This request must contain the valid
>> Parameters.SetFile.FileObject, this
>> FileObject is created by the system which calls
>> IoCreateFile(
>> FILE_RENAME_INFORMATION->FileName ). The FSD uses
>> Parameters.SetFile.FileObject instead the fully
>> qualified file name. If
>> Parameters.SetFile.FileObject is NULL then this is a
>> relative rename.
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

Use IoCreateFile( … , IO_OPEN_TARGET_DIRECTORY ) instead ZwCreateFile.
IoCreateFile is documented in the WDK( and in the IFSDK ).

“rahul naik” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> i made changes as per ur suggestion but i m still
> getting error c0000033.
>
> i also tried with RootDirectory field in
> FILE_RENAME_INFORMATION structure but it renames the
> file into source directory instead of target
> directory. I am passing handle of target directory in
> link_info->RootDirectory and link_info->FileName as
> “0.tmp”
>
> DWORD HoldFileBack( PDEVICE_OBJECT next_device,
> PFILE_OBJECT file_obj )
> {
> PFILE_RENAME_INFORMATION link_info = NULL;
> NTSTATUS status;
> UNICODE_STRING obj_name;
> OBJECT_ATTRIBUTES object;
> IO_STATUS_BLOCK io_status;
> HANDLE trg_dir_handle;
> PFILE_OBJECT trg_file_obj;
>
> //allocate memory for link_info
> link_info = ExAllocatePool( NonPagedPool, sizeof(
> FILE_RENAME_INFORMATION )
> + MAX_FILENAME_LENGTH );
> if( NULL == link_info )
> {
> DbgPrint( “No memory for Link_info\n” );
> return 1;
> }
>
> memset( link_info, 0, sizeof( FILE_RENAME_INFORMATION
> ) + MAX_FILENAME_LENGTH );
>
> //create link filename
> wcscpy( link_info->FileName, L"\??\C:\hlink" );
> RtlInitUnicodeString( &obj_name, link_info->FileName
> );
>
> InitializeObjectAttributes(&object,&obj_name,OBJ_KERNEL_HANDLE
> ,NULL,NULL);
> status = ZwCreateFile( &trg_dir_handle,
> GENERIC_WRITE, &object, &io_status, NULL, 0,
> FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
> FILE_DIRECTORY_FILE,
> NULL, 0 );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> return 1;
> }
>
> status = ObReferenceObjectByHandle( trg_dir_handle,
> GENERIC_WRITE, NULL,
> KernelMode, (PVOID*)&trg_file_obj,
> NULL );
> if ( status != STATUS_SUCCESS )
> {
> DbgPrint( “Error Opening target directory\n” );
> ZwClose( trg_dir_handle );
> return 1;
> }
>
> wcscpy( link_info->FileName,
> L"\??\C:\hlink\0.tmp" );
> link_info->FileNameLength = wcslen(
> link_info->FileName ) * 2;
>
> //now pass the rename irp down
> status = SetFileInfo( next_device, file_obj,
> trg_file_obj, link_info,
> sizeof( FILE_RENAME_INFORMATION ) +
> link_info->FileNameLength,
> FileRenameInformation, NULL );
> if( status != STATUS_SUCCESS )
> {
> DbgPrint( “rename Failed\n” );
> ExFreePool( link_info );
> return 1;
> }
> ExFreePool( link_info );
>
> return 0;
> }
>
> — Slava Imameyev wrote:
>
>> This request must contain the valid
>> Parameters.SetFile.FileObject, this
>> FileObject is created by the system which calls
>> IoCreateFile(
>> FILE_RENAME_INFORMATION->FileName ). The FSD uses
>> Parameters.SetFile.FileObject instead the fully
>> qualified file name. If
>> Parameters.SetFile.FileObject is NULL then this is a
>> relative rename.
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

Hi,

i m trying to open target directory nbut it is giving
error c0000005
status = IoCreateFile( &trg_dir_handle, GENERIC_WRITE,
&object, &io_status, NULL, 0,
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL, 0, CreateFileTypeNone, NULL,
IO_OPEN_TARGET_DIRECTORY );

Thanks,
Rahul

— Slava Imameyev wrote:

> Use IoCreateFile( … , IO_OPEN_TARGET_DIRECTORY
> ) instead ZwCreateFile.
> IoCreateFile is documented in the WDK( and in the
> IFSDK ).
>
> “rahul naik” wrote in
> message news:xxxxx@ntfsd…
> > Hi,
> >
> > i made changes as per ur suggestion but i m still
> > getting error c0000033.
> >
> > i also tried with RootDirectory field in
> > FILE_RENAME_INFORMATION structure but it renames
> the
> > file into source directory instead of target
> > directory. I am passing handle of target directory
> in
> > link_info->RootDirectory and link_info->FileName
> as
> > “0.tmp”
> >
> > DWORD HoldFileBack( PDEVICE_OBJECT next_device,
> > PFILE_OBJECT file_obj )
> > {
> > PFILE_RENAME_INFORMATION link_info = NULL;
> > NTSTATUS status;
> > UNICODE_STRING obj_name;
> > OBJECT_ATTRIBUTES object;
> > IO_STATUS_BLOCK io_status;
> > HANDLE trg_dir_handle;
> > PFILE_OBJECT trg_file_obj;
> >
> > //allocate memory for link_info
> > link_info = ExAllocatePool( NonPagedPool, sizeof(
> > FILE_RENAME_INFORMATION )
> > + MAX_FILENAME_LENGTH );
> > if( NULL == link_info )
> > {
> > DbgPrint( “No memory for Link_info\n” );
> > return 1;
> > }
> >
> > memset( link_info, 0, sizeof(
> FILE_RENAME_INFORMATION
> > ) + MAX_FILENAME_LENGTH );
> >
> > //create link filename
> > wcscpy( link_info->FileName, L"\??\C:\hlink" );
> > RtlInitUnicodeString( &obj_name,
> link_info->FileName
> > );
> >
> >
>
InitializeObjectAttributes(&object,&obj_name,OBJ_KERNEL_HANDLE
> > ,NULL,NULL);
> > status = ZwCreateFile( &trg_dir_handle,
> > GENERIC_WRITE, &object, &io_status, NULL, 0,
> > FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
> > FILE_DIRECTORY_FILE,
> > NULL, 0 );
> > if ( status != STATUS_SUCCESS )
> > {
> > DbgPrint( “Error Opening target directory\n” );
> > return 1;
> > }
> >
> > status = ObReferenceObjectByHandle(
> trg_dir_handle,
> > GENERIC_WRITE, NULL,
> > KernelMode, (PVOID*)&trg_file_obj,
> > NULL );
> > if ( status != STATUS_SUCCESS )
> > {
> > DbgPrint( “Error Opening target directory\n” );
> > ZwClose( trg_dir_handle );
> > return 1;
> > }
> >
> > wcscpy( link_info->FileName,
> > L"\??\C:\hlink\0.tmp" );
> > link_info->FileNameLength = wcslen(
> > link_info->FileName ) * 2;
> >
> > //now pass the rename irp down
> > status = SetFileInfo( next_device, file_obj,
> > trg_file_obj, link_info,
> > sizeof( FILE_RENAME_INFORMATION ) +
> > link_info->FileNameLength,
> > FileRenameInformation, NULL );
> > if( status != STATUS_SUCCESS )
> > {
> > DbgPrint( “rename Failed\n” );
> > ExFreePool( link_info );
> > return 1;
> > }
> > ExFreePool( link_info );
> >
> > return 0;
> > }
> >
> > — Slava Imameyev wrote:
> >
> >> This request must contain the valid
> >> Parameters.SetFile.FileObject, this
> >> FileObject is created by the system which calls
> >> IoCreateFile(
> >> FILE_RENAME_INFORMATION->FileName ). The FSD uses
> >> Parameters.SetFile.FileObject instead the fully
> >> qualified file name. If
> >> Parameters.SetFile.FileObject is NULL then this
> is a
> >> relative rename.
> >
> >
> >
> >
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam
> protection around
> > http://mail.yahoo.com
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com