NULL target files name in rename operation?

NTFSD
1

All,

I am seeing the rename operation in my filter driver, where target FileName is empty.

When can we accept the target file name to be empty? What kind of operation is this?
My understanding was that if rename is happening we will get source and target files names.

thanks in advance. Any help will be appreciated?

This is the event in the Processmonitor, as you can see FileName is empty.

Date & Time: 3/18/2014 1:27:45 PM
Event Class: File System
Operation: IRP_MJ_SET_INFORMATION
Result: ACCESS DENIED
Path: \FS34093a\USER_PROFILES_E\NTUSER.DAT
TID: 3100
Duration: 0.0017078

Type: SetRenameInformationFile
ReplaceIfExists: True
FileName:

2

Rename in case on the same volume will be a simple move operation.
And in case of on different volume it’ll be a copy the delete (from original volume) operation.
i think,need to check your post callback.

./!!!

3

thanks for your reply. The problem is i can’t reproduce the issue, i am just relying on the ProcessMon output.

What do you mean by “Copy the delete (From original volume)”?

I understand if the volume is different, it needs to delete the file from original volume. So this “SetRenameInformationFile” call without Target file name is the indication of the delete from original volume?

4

Watashi no warui eigo no tame m?shiwake arimasen !!!

I mean in a case of rename operation if you are doing a rename of a file on
The same volume it’ll be a simple move operation…
And if you are doing a rename opeartion from one volujme to another volume
It will be a copy and delete operation.

Now you need to check for two things in your filter…

  1. check your post callback
    2.also check your close operation callback i doubt you may miss something in
    close for certain opeartion/cases.
5

> I am seeing the rename operation in my filter driver, where target

FileName is empty.

Are you remembering about SL_OPEN_TARGET_DIRECTORY (“Open with the name you
want the rename to be”)?

6

Well, does the rename work without you involved ? Users can always send
requests that don’t make sense (IRP_MJ_CREATE with names of files that
don’t exist and such) and they fail. It only becomes a problem if such a
rename succeeds without your filter (or file system) and doesn’t work on
yours. But you didn’t really explain much about your setup… So there
simply might not be a problem.

FWIW, I wrote some posts about renames here:
http://fsfilters.blogspot.com/2011/06/rename-in-file-system-filters-part-i.htmland
here:
http://fsfilters.blogspot.com/2011/06/rename-in-file-system-filters-part-ii.html.
It explains how the name in the FILE_RENAME_INFORMATION is used and how the
SL_OPEN_TARGET_DIRECTORY helps …

Thanks,
Alex.

On Fri, Mar 21, 2014 at 8:40 AM, Rod Widdowson wrote:

> I am seeing the rename operation in my filter driver, where target
>> FileName is empty.
>>
>
> Are you remembering about SL_OPEN_TARGET_DIRECTORY (“Open with the name
> you want the rename to be”)?
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

7

Thanks a lot for reply.

Nope i do not remembering SL_OPEN_TARGET_DIRECTORY. If i understand correctly, SL_OPEN_TARGET_DIRECTORY flag is set to open the destination directory for a rename operation.

I am still not clear, what is purpose of sending SetRenameInformationFile IO without FileName?

http://fsfilters.blogspot.com/2011/06/rename-in-file-system-filters-part-ii.html

In the above blog by Alex, he suggests that “FS simply look at the TargetFileObject->FileName to get the file name and FILE_RENAME_INFORMATION->FileName is ignored”.

Is this what is happening here? If the SL_OPEN_TARGET_DIRECTORY flag is set and if FILE_RENAME_INFORMATION->FileName is NULL, then we need to get the target file name from TargetFileObject->FileName? Because i need the target filename in my filter driver and i am only looking at FILE_RENAME_INFORMATION to get the target filename.

But after above IO is completed (without my filter driver), file gets deleted from the directory. The next Create call on the same file creates a new file?

thanks

8

thanks Alex.

I did read your blogs and they were really helpful. Thanks a lot for that.

Yes it does works without my filer driver. It seems like this call is deleting the file. Because next CREATE call on the same file is Creating the file again, instead of opening it.

IRP_MJ_SET_INFO - Without Target File Name
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
IRP_MJ_CREATE - New File is created. (OpenResult: Created)

With my filter driver, i simply fail the call because i don’t see the FileName.

Setup is simple. Customer has its own web application. Which creates the user profile in c:\user folder and try to change the permissions and registry. Then they move the profile from C:\user drive to F:\user drive.

So setup is simple, its just i can’t reproduce similar IOs with my app.