Open by file ID

NTFSD
1

Hi,

I will be very appreciated if you could help me.

I am trying to open file by its ID using ZwCreateFile().
It always returns STATUS_OBJECT_NAME_NOT_FOUND.

First I open file by its name and query it for FileInternalInformation.

As I understand it contains LARGE_INTEGER IndexNumber, which
can be used as file ID. Am I right?

Then I close the file.

After that I create a path in form ??<drive_letter>:<file_id>

RtlAppendUnicodeToString(&FileName, L"??<drive_letter>:");
RtlCopyMemory(
((PCHAR) FileName.Buffer) + FileName.Length,
(PCHAR) &InternalInfo->IndexNumber,
sizeof(LARGE_INTEGER)
);
FileName.Length += sizeof(LARGE_INTEGER);

I pass this name (as object attributes) to ZwCreateFile() and get
STATUS_OBJECT_NAME_NOT_FOUND.
I have tried both NTFS and CDFS on NT4.

What am I doing wrong?

Thanks in advance,
Leonid.</drive_letter></file_id></drive_letter>

2

The code snippet below works for me. I think what you miss to do (if we
ignore missing double L"\??\…" where you define file name), is to get
handle to (root) directory on the volume first and then open file by ID.

HANDLE hRoot = (HANDLE) -1;
HANDLE hFile = (HANDLE) -1;

RtlInitUnicodeString(&fileNameUnicodeString, L"\??\<drive_letter>:\“);

RtlZeroMemory(&objectAttributes, sizeof(OBJECT_ATTRIBUTES));

InitializeObjectAttributes(&objectAttributes, &fileNameUnicodeString,
OBJ_CASE_INSENSITIVE, NULL, NULL);

ntStatus = ZwOpenFile(&hRoot, SYNCHRONIZE|FILE_READ_ATTRIBUTES,
&objectAttributes, pIoStatusBlock,
FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
FILE_DIRECTORY_FILE);

if (NT_SUCCESS(ntStatus))
{
if (NT_SUCCESS(pIoStatusBlock->Status))
{
RtlCopyMemory((PCHAR) fileNameUnicodeString.Buffer,
(PCHAR) &InternalInfo->IndexNumber, sizeof(LARGE_INTEGER));

fileNameUnicodeString.Length = sizeof(LARGE_INTEGER);
fileNameUnicodeString.MaximumLength = sizeof(LARGE_INTEGER);

RtlZeroMemory(&objectAttributes, sizeof(OBJECT_ATTRIBUTES));

InitializeObjectAttributes(&objectAttributes, &fileNameUnicodeString,
OBJ_CASE_INSENSITIVE, hRoot, NULL);

ntStatus = ZwOpenFile(&hFile, SYNCHRONIZE|FILE_READ_ATTRIBUTES,
&objectAttributes, pIoStatusBlock,
FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
FILE_OPEN_BY_FILE_ID);

ntStatus = ZwClose(hFile);

ntStatus = ZwClose(hRoot);
}
}

I didn’t experiment if the code below works if I open hRoot as
L”\??\<drive_letter>:\SomeOtherDir". If you will trace RealtedFileObject
member of file object opened by file ID, you will see that is “related” to
hRoot. I found also that RelatedFileObject member can point to some “root”
file object opened by file ID (e.g. Hummingbird NFS Maestro Server), which
makes getting (readable) file name in pre-completing IRP_MJ_CREATE
interesting.

WBR Primoz

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Monday, July 01, 2002 11:26 AM
To: File Systems Developers
Subject: [ntfsd] Open by file ID

Hi,

I will be very appreciated if you could help me.

I am trying to open file by its ID using ZwCreateFile().
It always returns STATUS_OBJECT_NAME_NOT_FOUND.

First I open file by its name and query it for FileInternalInformation.

As I understand it contains LARGE_INTEGER IndexNumber, which can be used as
file ID. Am I right?

Then I close the file.

After that I create a path in form ??<drive_letter>:<file_id>

RtlAppendUnicodeToString(&FileName, L"??<drive_letter>:"); RtlCopyMemory(
((PCHAR) FileName.Buffer) + FileName.Length,
(PCHAR) &InternalInfo->IndexNumber,
sizeof(LARGE_INTEGER)
);
FileName.Length += sizeof(LARGE_INTEGER);

I pass this name (as object attributes) to ZwCreateFile() and get
STATUS_OBJECT_NAME_NOT_FOUND. I have tried both NTFS and CDFS on NT4.

What am I doing wrong?

Thanks in advance,
Leonid.

—
You are currently subscribed to ntfsd as: xxxxx@hermes.si To
unsubscribe send a blank email to %%email.unsub%%</drive_letter></file_id></drive_letter></drive_letter></drive_letter>