Question about testing rename operations

NTFSD
1

Hello

I have impelmented the code in the article “Cracking Rename Operations”.

Now it seems when I type: “ren file1.txt file2.txt” or “move file1.txt
…\file2.txt” I always receive processFQRename().

How can I test the other two rename modes (processRelativeRename and
processSimpleRename)?

What user mode code can be written to test these modes?

Regards,
Elias

2

Maybe the best thing will be if you make a testprogram
using native API (NtSetInformationFile).
This should give you full control over
what rename will come.

L.