The usual method is to intercept the IRP_MJ_CREATE calls and maintain
a private list of the mappings between the FileObject and the file name
(or parse the file name and only add the file object to your list if it
is one your interested in). Only during the IRP_MJ_CREATE call will the
FileObject->FileName field be valid (unless it is an open by ID).
You will also need to intercept the IRP_MJ_CLOSE call to free your list
entry.
Shaun
kimura@ps.bsc.fujitsu.co.jp wrote:
>Hello!
>
>I am developing the filter driver of Windows2000.
>Please reply to my question.
>---------------------------------------------------------------
>
>
>I made the filter driver for attach to “The File System Driver of NTFS”.
>
>In dispatch of IRP_MJ_WRITE, a path name may be unacquirable from FILEOBJECT.
>
>Please teach a good method.
>
>---------------------------------------------------------------
>
>
>Plase see a marking of "".
>
>[conditions]
>
>FSD : NTFS
>IRP->Flags : IRP_PAGING_IO bit –> ON
>
>NTSTATUS SFWriteDispatch(
> PDEVICE_OBJECT DeviceObject, // Our device object
> PIRP Irp) // I/O Request Packet
>{
> NTSTATUS RC = STATUS_SUCCESS;
> PIO_STACK_LOCATION PtrNextIoStackLocation = NULL;
> PIO_STACK_LOCATION PtrCurrentStackLocation = NULL;
> PtrSFilterDeviceExtension PtrDeviceExtension = NULL;
> BOOLEAN AcquiredExtension = FALSE;
> BOOLEAN CompleteIrp = FALSE;
> PDEVICE_OBJECT PtrTargetDeviceObject = NULL;
>
> ULONG ReturnedInformation = 0;
> IO_STATUS_BLOCK Iosb;
>
> try {
> PtrCurrentStackLocation = IoGetCurrentIrpStackLocation(Irp);
>
> PtrDeviceExtension = (PtrSFilterDeviceExtension)(DeviceObject-
>>DeviceExtension);
> SFilterAssertExtPtrValid(PtrDeviceExtension);
>
> // our target device object.
> ExAcquireResourceExclusiveLite(&(PtrDeviceExtension-
>>DeviceExtensionResource), TRUE);
> AcquiredExtension = TRUE;
>
> if ((PtrDeviceExtension->NodeIdentifier.NodeType == SFILTER_NODE
>_TYPE_ATTACHED_DEVICE)
> && (PtrDeviceExtension->DeviceExtensionFlags &
>SFILTER_DEV_EXT_ATTACHED)){
> if( ((Irp->Flags & IRP_PAGING_IO) || (Irp->Flags &
>IRP_SYNCHRONOUS_PAGING_IO) ) &&
> ( PtrCurrentStackLocation-
>>Parameters.Write.Length ) ){
> if( PtrCurrentStackLocation->FileObject-
>>FileName == NULL ){
>
> //
> // This is a problem part!!!
> // I want to acquire a file name.
>
> // In this cases, FO_STREAMFILE bit of
>Flags is “ON”
> // I want to acquire a Path name from
>FileObject, or
> // would not use STREAM_FILE
$B!*
(B
> // *******************************
> }
> }
> PtrNextIoStackLocation = IoGetNextIrpStackLocation(Irp);
>
> *PtrNextIoStackLocation = *PtrCurrentStackLocation;
>
> IoSetCompletionRoutine(Irp, SFilterDefaultCompletion,
>PtrDeviceExtension, TRUE, TRUE, TRUE);
>
> PtrTargetDeviceObject = PtrDeviceExtension-
>>TargetDeviceObject;
>
> SFilterIncrementLargeInteger(PtrDeviceExtension-
>>OutstandingIoRequests,
> (unsigned long)1,
> &(PtrDeviceExtension->IoRequestsSpinLock));
>
>
> KeClearEvent(&(PtrDeviceExtension->IoInProgressEvent));
>
> if (AcquiredExtension) {
> SFilterReleaseResource(&(PtrDeviceExtension-
>>DeviceExtensionResource));
> AcquiredExtension = FALSE;
> }
>
> RC = IoCallDriver(PtrTargetDeviceObject, Irp);
> try_return(RC);
> }
> // IoCallDriver()
$B<:GT
(B
> CompleteIrp = TRUE;
> try_return(RC = STATUS_INVALID_DEVICE_REQUEST);
>
> try_exit:
> NOTHING;
>
> }
> finally {
>
> if (AcquiredExtension) {
> SFilterReleaseResource(&(PtrDeviceExtension-
>>DeviceExtensionResource));
> AcquiredExtension = FALSE;
> }
>
> if (CompleteIrp) {
> Irp->IoStatus.Status = RC;
> Irp->IoStatus.Information = ReturnedInformation;
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> }
>
> }
>
> return(RC);
>}
>
>—
>You are currently subscribed to ntfsd as: xxxxx@sdlabs.demon.co.uk
>To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com