minifilter FltGetFileNameinfomation

NTFSD
1

I use minifilter “passthrough.c” to filter CREATE IRP,
in “PtPreOperationCreate”, i want to get filename,so i write code:

PFILE_OBJECT FileObject = FltObjects->FileObject;
KdPrint( (“%ws”, FileObject->FileName.Buffer) );
…
i open debugView.exe, it’s run well
/*******************************************/
i write code instead:

FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED, &pFLT );
KdPrint( (“%ws”, pFlt->Name.Buffer) );
…
when i open debugView.exe, show BSOD, information is about NOPAGE area happend PAGE error, i try KdPrint( (“%x”, &FileObject->FileName.Buffer) ), the error is countine,i get the FileObject address is 0xffxxxxxx

please tell me why? thank you:)

2

You are not done – you must also call FltParseFileNameInformation. Try this:

status = FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &pFLT );

if( !NT_SUCCESS( status ) )
return FLT_PREOP_SUCCESS_NO_CALLBACK;

status = FltParseFileNameInformation( pFLT );

if( !NT_SUCCESS( status ) )
{
FltReleaseFileNameInformation( pFLT );
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

DoTraceMessage( DEBUG_ANY, “%!FUNC! File name %wZ”, &pFLT->Name );

Ken

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, May 17, 2007 9:26 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] minifilter FltGetFileNameinfomation

I use minifilter “passthrough.c” to filter CREATE IRP,
in “PtPreOperationCreate”, i want to get filename,so i write code:

PFILE_OBJECT FileObject = FltObjects->FileObject;
KdPrint( (“%ws”, FileObject->FileName.Buffer) );
…
i open debugView.exe, it’s run well
/*******************************************/
i write code instead:

FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED, &pFLT );
KdPrint( (“%ws”, pFlt->Name.Buffer) );
…
when i open debugView.exe, show BSOD, information is about NOPAGE area happend PAGE error, i try KdPrint( (“%x”,
&FileObject->FileName.Buffer) ), the error is countine,i get the FileObject address is 0xffxxxxxx

please tell me why? thank you:)

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

FltParseFileNameInformation is only necessary if he wants the volume, share,
extension, stream, finalComponent and so on, he is only using the name.
Maybe he is calling this function at elevated IRQL in a post operation
callback.

/Daniel

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> You are not done – you must also call FltParseFileNameInformation. Try
> this:
>
>
> status = FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED |
> FLT_FILE_NAME_QUERY_DEFAULT, &pFLT );
>
> if( !NT_SUCCESS( status ) )
> return FLT_PREOP_SUCCESS_NO_CALLBACK;
>
> status = FltParseFileNameInformation( pFLT );
>
> if( !NT_SUCCESS( status ) )
> {
> FltReleaseFileNameInformation( pFLT );
> return FLT_PREOP_SUCCESS_NO_CALLBACK;
> }
>
> DoTraceMessage( DEBUG_ANY, “%!FUNC! File name %wZ”, &pFLT->Name );
>
>
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Thursday, May 17, 2007 9:26 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] minifilter FltGetFileNameinfomation
>
> I use minifilter “passthrough.c” to filter CREATE IRP,
> in “PtPreOperationCreate”, i want to get filename,so i write code:
>
> PFILE_OBJECT FileObject = FltObjects->FileObject;
> KdPrint( (“%ws”, FileObject->FileName.Buffer) );
> …
> i open debugView.exe, it’s run well
> / ******************************************* /
> i write code instead:
>
> FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED, &pFLT );
> KdPrint( (“%ws”, pFlt->Name.Buffer) );
> …
> when i open debugView.exe, show BSOD, information is about NOPAGE area
> happend PAGE error, i try KdPrint( (“%x”,
> &FileObject->FileName.Buffer) ), the error is countine,i get the
> FileObject address is 0xffxxxxxx
>
>
> please tell me why? thank you:)
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

Since buffer isn’t null terminated, wouldn’t the way he was trying to
print it cause an occasional
‘page fault in non paged area’ stop if he was backed against a page
boundary?

Daniel Terhell wrote:

FltParseFileNameInformation is only necessary if he wants the volume,
share, extension, stream, finalComponent and so on, he is only using
the name. Maybe he is calling this function at elevated IRQL in a post
operation callback.

/Daniel

“Ken Cross” wrote in message news:xxxxx@ntfsd…
>
>> You are not done – you must also call FltParseFileNameInformation.
>> Try this:
>>
>>
>> status = FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED |
>> FLT_FILE_NAME_QUERY_DEFAULT, &pFLT );
>>
>> if( !NT_SUCCESS( status ) )
>> return FLT_PREOP_SUCCESS_NO_CALLBACK;
>>
>> status = FltParseFileNameInformation( pFLT );
>>
>> if( !NT_SUCCESS( status ) )
>> {
>> FltReleaseFileNameInformation( pFLT );
>> return FLT_PREOP_SUCCESS_NO_CALLBACK;
>> }
>>
>> DoTraceMessage( DEBUG_ANY, “%!FUNC! File name %wZ”, &pFLT->Name );
>>
>>
>>
>> Ken
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of
>> xxxxx@gmail.com
>> Sent: Thursday, May 17, 2007 9:26 PM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] minifilter FltGetFileNameinfomation
>>
>> I use minifilter “passthrough.c” to filter CREATE IRP,
>> in “PtPreOperationCreate”, i want to get filename,so i write code:
>>
>> PFILE_OBJECT FileObject = FltObjects->FileObject;
>> KdPrint( (“%ws”, FileObject->FileName.Buffer) );
>> …
>> i open debugView.exe, it’s run well
>> / ******************************************* /
>> i write code instead:
>>
>> FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED, &pFLT );
>> KdPrint( (“%ws”, pFlt->Name.Buffer) );
>> …
>> when i open debugView.exe, show BSOD, information is about NOPAGE
>> area happend PAGE error, i try KdPrint( (“%x”,
>> &FileObject->FileName.Buffer) ), the error is countine,i get the
>> FileObject address is 0xffxxxxxx
>>
>>
>> please tell me why? thank you:)
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

Yes he should use %wZ format specifier to print the unicode string and not
print the buffer. Note that although you can call DbgPrint at any level <=
DIRQL these format specifiers can only be used at PASSIVE_LEVEL.

/Daniel

MM" wrote in message news:xxxxx@ntfsd…
> Since buffer isn’t null terminated, wouldn’t the way he was trying to
> print it cause an occasional
> ‘page fault in non paged area’ stop if he was backed against a page
> boundary?
>
> Daniel Terhell wrote:
>
>> FltParseFileNameInformation is only necessary if he wants the volume,
>> share, extension, stream, finalComponent and so on, he is only using the
>> name. Maybe he is calling this function at elevated IRQL in a post
>> operation callback.
>>
>> /Daniel
>>
>>
>>
>> “Ken Cross” wrote in message news:xxxxx@ntfsd…
>>
>>> You are not done – you must also call FltParseFileNameInformation. Try
>>> this:
>>>
>>>
>>> status = FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED |
>>> FLT_FILE_NAME_QUERY_DEFAULT, &pFLT );
>>>
>>> if( !NT_SUCCESS( status ) )
>>> return FLT_PREOP_SUCCESS_NO_CALLBACK;
>>>
>>> status = FltParseFileNameInformation( pFLT );
>>>
>>> if( !NT_SUCCESS( status ) )
>>> {
>>> FltReleaseFileNameInformation( pFLT );
>>> return FLT_PREOP_SUCCESS_NO_CALLBACK;
>>> }
>>>
>>> DoTraceMessage( DEBUG_ANY, “%!FUNC! File name %wZ”, &pFLT->Name );
>>>
>>>
>>>
>>> Ken
>>>
>>>
>>> -----Original Message-----
>>> From: xxxxx@lists.osr.com
>>> [mailto:xxxxx@lists.osr.com] On Behalf Of
>>> xxxxx@gmail.com
>>> Sent: Thursday, May 17, 2007 9:26 PM
>>> To: Windows File Systems Devs Interest List
>>> Subject: [ntfsd] minifilter FltGetFileNameinfomation
>>>
>>> I use minifilter “passthrough.c” to filter CREATE IRP,
>>> in “PtPreOperationCreate”, i want to get filename,so i write code:
>>>
>>> PFILE_OBJECT FileObject = FltObjects->FileObject;
>>> KdPrint( (“%ws”, FileObject->FileName.Buffer) );
>>> …
>>> i open debugView.exe, it’s run well
>>> / ******************************************* /
>>> i write code instead:
>>>
>>> FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED, &pFLT );
>>> KdPrint( (“%ws”, pFlt->Name.Buffer) );
>>> …
>>> when i open debugView.exe, show BSOD, information is about NOPAGE area
>>> happend PAGE error, i try KdPrint( (“%x”,
>>> &FileObject->FileName.Buffer) ), the error is countine,i get the
>>> FileObject address is 0xffxxxxxx
>>>
>>>
>>> please tell me why? thank you:)
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@comcast.net
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>