I’m using the template mini-filter driver from Visual Studio 2013 to try and override the file system name of all mounted network drives.
The problem I am having is that the custom file system name I want to set is a different length to the original value (NTFS). E.g. If I set FileSystemName to ‘CUSTOM’, and set the length accordingly, Windows is displaying the result as ‘CUST??’, where the final two characters are rubbish that changes every time.
Below is the post-op callback for IRP_MJ_QUERY_VOLUME_INFORMATION:
FLT_POSTOP_CALLBACK_STATUS
CustomPostOpQueryVolumeInformation(
Inout PFLT_CALLBACK_DATA Data,
In PCFLT_RELATED_OBJECTS FltObjects,
In_opt PVOID CompletionContext,
In FLT_POST_OPERATION_FLAGS Flags
)
{
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(CompletionContext);
UNREFERENCED_PARAMETER(Flags);
switch (Data->Iopb->Parameters.QueryVolumeInformation.FsInformationClass)
{
case FileFsAttributeInformation:
CustomFsAttributeInformation(
Data->Iopb->Parameters.QueryVolumeInformation.Length,
Data->Iopb->Parameters.QueryVolumeInformation.VolumeBuffer,
Data->IoStatus);
FltSetCallbackDataDirty(Data);
break;
default:
break;
}
return FLT_POSTOP_FINISHED_PROCESSING;
}
And the method which is making the change:
NTSTATUS
CustomFsAttributeInformation(
ULONG VolumeBufferLength,
PVOID VolumeBuffer,
IO_STATUS_BLOCK IoStatus
)
{
PFILE_FS_ATTRIBUTE_INFORMATION SystemBuffer;
PFILE_FS_ATTRIBUTE_INFORMATION Buffer;
ULONG fsFlags;
LONG maxComponentLength;
ULONG RequiredLength;
SystemBuffer = (PFILE_FS_ATTRIBUTE_INFORMATION)VolumeBuffer;
fsFlags = SystemBuffer->FileSystemAttributes;
maxComponentLength = SystemBuffer->MaximumComponentNameLength;
RtlZeroMemory(VolumeBuffer, VolumeBufferLength);
if (VolumeBufferLength < sizeof(PFILE_FS_ATTRIBUTE_INFORMATION))
{
return STATUS_INFO_LENGTH_MISMATCH;
}
Buffer = (PFILE_FS_ATTRIBUTE_INFORMATION) VolumeBuffer;
Buffer->FileSystemAttributes = fsFlags;
Buffer->MaximumComponentNameLength = maxComponentLength;
Buffer->FileSystemNameLength = 12;
RequiredLength = sizeof(FILE_FS_ATTRIBUTE_INFORMATION) + 12 - sizeof(WCHAR);
if (VolumeBufferLength < RequiredLength) {
IoStatus.Information = sizeof(FILE_FS_ATTRIBUTE_INFORMATION);
return STATUS_BUFFER_OVERFLOW;
}
RtlCopyMemory(Buffer->FileSystemName, L"CUSTOM", 12);
IoStatus.Information = RequiredLength;
return STATUS_SUCCESS;
}
I’ve tried a couple of different approaches, with pre and post-op, and different methods of changing the FileSystemName value, but all end up with the same result, where only the first 4 characters are changed.
Am I on the right track here?
Cheers,
Matt