Re[2]: Re[2]: Re[2]: Overwrite Issue when reparsing MS word to a different volume

If the Length value in the UNICODE_STRING is correct, that is it does
not reflect additional characters beyond the valid name, then there must
be some other issue going on. Have you confirmed this functionality
using the FileTest utility?

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@yahoo.com
To: “Windows File Systems Devs Interest List”
Sent: 8/30/2017 2:13:33 AM
Subject: RE:[ntfsd] Re[2]: Re[2]: Overwrite Issue when reparsing MS word
to a different volume

>a unicode_string containing :
>
>e:\1.docx
>
>verified it in memory. Also I feel like it is not a string validation
>problem.
>Also in process monitor logs prior to my issue, I see 2 consequent
>createfile calls with same path one fails with NAME INVALID error the
>other succeeds
>The only difference is “Access System Security” is removed from desired
>access in the latter call.
>That’s why I feel it might be something different than path format.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

No. I was not familiar with file test utility. Thanks for introducing. I checked the tool.

The problem is resolved by now. I have changed the hooked API from NTSetInformationFile to ReplaceFile(which MS Word was using) and tried to create the file there and it succeeded.