IRP_MJ_READ and FltGetDestinationFileNameInformation

NTFSD
1

Is it not possible to retrieve the file name in a pre-op callback in a file system minifilter? i have no problem with this in a pre or post-op IRP_MJ_CREATE callback.

2

just to clarify, i am getting no file name info back when registering for IRP_MJ_READ callbacks. i can’t seem to find any docs which explicitly state this is expected behavior.

3

Depends, but if the IRP_MJ_READ is a paging operation, then the FltGetFileNameInformation API will fail (it states so in the docs). Also, you should not query the file name
information during IRP_MJ_READ, but during IRP_MJ_CREATE and store it in your context.

xxxxx@yahoo.com wrote:

just to clarify, i am getting no file name info back when registering for IRP_MJ_READ callbacks. i can’t seem to find any docs which explicitly state this is expected behavior.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

4

Thanks. I was starting to go down that path based on some other references I’ve been reading.

5

You must be trying to query a file name in the paging read path. That would
fail since it is not safe (well not really, but for the starters yes it
isn’t) to issue I/Os in the paging I/O path. What exactly are you trying to
achieve? Why don’t you query file name in pre/post create and maintain it in
stream handle context?

Regards,
Ayush Gupta
Software Consultant & Owner,
AI Consulting

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Friday, February 25, 2011 2:35 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] IRP_MJ_READ and FltGetDestinationFileNameInformation

just to clarify, i am getting no file name info back when registering for
IRP_MJ_READ callbacks. i can’t seem to find any docs which explicitly state
this is expected behavior.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer