Out of curiosity:
I have an FS filter driver that wants to get the name of a file after NTFS
has successfully finished its CREATE. Given the FILE_OBJECT, it seems I
have two choices to fetch this information. I could call
ObQueryNameString() to get the name of the FILE_OBJECT, or I could send down
an IRP I have with an IRP_MJ_QUERY_INFORMATION (class =
FileNameInformation).
With the IRP method, I know the call goes down to the FSD below the filter
driver. But where does ObQueryNameString() enter the I/O stack? Is it
similar to ZwQueryInformationFile() in entering from the top of the stack?
(yes, I know I could intercept the FILE_OBJECT’s FileName string before the
CREATE goes down to the FSD, but for various reasons, I want to query for
the information instead.)
Carl
Ob… enters the top of the stack. Thus, not only is there re-entrancy
issue, which needs handling, but excessive stack usage.
Querying after create has an advantage and a disadvantage - extra work, it
might fail, but also it’s the only way to get the file name for file open by
file ID.
Carl Appellof wrote:
Out of curiosity:
I have an FS filter driver that wants to get the name of a file after NTFS
has successfully finished its CREATE. Given the FILE_OBJECT, it seems I
have two choices to fetch this information. I could call
ObQueryNameString() to get the name of the FILE_OBJECT, or I could send down
an IRP I have with an IRP_MJ_QUERY_INFORMATION (class =
FileNameInformation).
With the IRP method, I know the call goes down to the FSD below the filter
driver. But where does ObQueryNameString() enter the I/O stack? Is it
similar to ZwQueryInformationFile() in entering from the top of the stack?
(yes, I know I could intercept the FILE_OBJECT’s FileName string before the
CREATE goes down to the FSD, but for various reasons, I want to query for
the information instead.)
Carl
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
… also it might not get the same name as you would get in dispatch due to
hard links in ntfs.
Will not work.
You need to call the FSD below you to get the filename.
Jamey
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Carl Appellof
Sent: Thursday, March 06, 2003 9:13 AM
To: File Systems Developers
Subject: [ntfsd] ObQueryNameString vs. IRP_MJ_QUERY_INFORMATION
Out of curiosity:
I have an FS filter driver that wants to get the name of a file after
NTFS
has successfully finished its CREATE. Given the FILE_OBJECT, it seems I
have two choices to fetch this information. I could call
ObQueryNameString() to get the name of the FILE_OBJECT, or I could send
down
an IRP I have with an IRP_MJ_QUERY_INFORMATION (class =
FileNameInformation).
With the IRP method, I know the call goes down to the FSD below the
filter
driver. But where does ObQueryNameString() enter the I/O stack? Is it
similar to ZwQueryInformationFile() in entering from the top of the
stack?
(yes, I know I could intercept the FILE_OBJECT’s FileName string before
the
CREATE goes down to the FSD, but for various reasons, I want to query
for
the information instead.)
Carl
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
> With the IRP method, I know the call goes down to the FSD below the
filter
driver. But where does ObQueryNameString() enter the I/O stack? Is
it
similar to ZwQueryInformationFile() in entering from the top of the
stack?
Yes, it sends the MJ_QUERY_INFORMATION IRP down.
Max
And it will cause reentrancy into your filter.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Thursday, March 06, 2003 1:01 PM
To: File Systems Developers
Subject: [ntfsd] Re: ObQueryNameString vs. IRP_MJ_QUERY_INFORMATION
With the IRP method, I know the call goes down to the FSD below the
filter
driver. But where does ObQueryNameString() enter the I/O stack? Is
it
similar to ZwQueryInformationFile() in entering from the top of the
stack?
Yes, it sends the MJ_QUERY_INFORMATION IRP down.
Max
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com