Register name provider failed

Hi

I tried to register a name provider in passThrough example as following, it failed to register the filer in windows 2008 with error INVALID PARMETER(c000000d), But it succeeded in windows 2003, Anyone can point out what wrong of the code?

if i remove the name call back, it is fine.

NTSTATUS
GenerateFileNameCallback(
__in PFLT_INSTANCE Instance,
__in PFILE_OBJECT FileObject,
__in_opt PFLT_CALLBACK_DATA CallbackData,
__in FLT_FILE_NAME_OPTIONS NameOptions,
__out PBOOLEAN CacheFileNameInformation,
__out PFLT_NAME_CONTROL FileName
)
{
NTSTATUS ntStatus = STATUS_SUCCESS;
PFLT_FILE_NAME_INFORMATION FileNameInformation = NULL;

if (CallbackData)
{
ntStatus = FltGetFileNameInformation(CallbackData, NameOptions, &FileNameInformation);
}
else
{
ntStatus = FltGetFileNameInformationUnsafe(FileObject, Instance, NameOptions, &FileNameInformation);
}

if (!NT_SUCCESS(ntStatus))
{
DbgPrint(“GenerateFileNameCallback failed to get file name:%wZ,status:%0x”,&FileObject->FileName,ntStatus);
return ntStatus;
}

*CacheFileNameInformation = TRUE;
ntStatus = FltCheckAndGrowNameControl(FileName, FileNameInformation->Name.Length);

if (!NT_SUCCESS(ntStatus))
{
DbgPrint(“FltCheckAndGrowNameControl:%wZ failed,status:%0x”,&FileObject->FileName,ntStatus);
return ntStatus;
}

RtlCopyUnicodeString(&FileName->Name, &FileNameInformation->Name);

FltReleaseFileNameInformation(FileNameInformation);

return ntStatus;
}

//
// This defines what we want to filter with FltMgr
//

CONST FLT_REGISTRATION FilterRegistration = {

sizeof( FLT_REGISTRATION ), // Size
FLT_REGISTRATION_VERSION, // Version
0, // Flags

NULL, // Context
Callbacks, // Operation callbacks

PtUnload, // MiniFilterUnload

PtInstanceSetup, // InstanceSetup
PtInstanceQueryTeardown, // InstanceQueryTeardown
PtInstanceTeardownStart, // InstanceTeardownStart
PtInstanceTeardownComplete, // InstanceTeardownComplete

GenerateFileNameCallback, // GenerateFileName
NULL, // GenerateDestinationFileName
NULL // NormalizeNameComponent

};

Thanks

BEN

As a WAG, you probably also need to provide NormalizeNameComponent and
NormalizeNameComponentEx (note that you cannot use the fileobject in the
latter for anything interesting except to get transactional context)

I’m pretty sure that I have persuade FltMgr to tell me about this sort of
problem. Try running your driver verified, or run with the checked version
of fltmgr and check the debugger for messages…

R

wrote in message news:xxxxx@ntfsd…
> Hi
>
> I tried to register a name provider in passThrough example as following,
> it failed to register the filer in windows 2008 with error INVALID
> PARMETER(c000000d), But it succeeded in windows 2003, Anyone can point out
> what wrong of the code?
>
> if i remove the name call back, it is fine.
>
> NTSTATUS
> GenerateFileNameCallback(
> in PFLT_INSTANCE Instance,
>
in PFILE_OBJECT FileObject,
> in_opt PFLT_CALLBACK_DATA CallbackData,
>
in FLT_FILE_NAME_OPTIONS NameOptions,
> out PBOOLEAN CacheFileNameInformation,
>
out PFLT_NAME_CONTROL FileName
> )
> {
> NTSTATUS ntStatus = STATUS_SUCCESS;
> PFLT_FILE_NAME_INFORMATION FileNameInformation = NULL;
>
>
> if (CallbackData)
> {
> ntStatus = FltGetFileNameInformation(CallbackData, NameOptions,
> &FileNameInformation);
> }
> else
> {
> ntStatus = FltGetFileNameInformationUnsafe(FileObject, Instance,
> NameOptions, &FileNameInformation);
> }
>
> if (!NT_SUCCESS(ntStatus))
> {
> DbgPrint(“GenerateFileNameCallback failed to get file
> name:%wZ,status:%0x”,&FileObject->FileName,ntStatus);
> return ntStatus;
> }
>
> *CacheFileNameInformation = TRUE;
> ntStatus = FltCheckAndGrowNameControl(FileName,
> FileNameInformation->Name.Length);
>
> if (!NT_SUCCESS(ntStatus))
> {
> DbgPrint(“FltCheckAndGrowNameControl:%wZ
> failed,status:%0x”,&FileObject->FileName,ntStatus);
> return ntStatus;
> }
>
> RtlCopyUnicodeString(&FileName->Name, &FileNameInformation->Name);
>
> FltReleaseFileNameInformation(FileNameInformation);
>
>
> return ntStatus;
> }
>
>
> //
> // This defines what we want to filter with FltMgr
> //
>
> CONST FLT_REGISTRATION FilterRegistration = {
>
> sizeof( FLT_REGISTRATION ), // Size
> FLT_REGISTRATION_VERSION, // Version
> 0, // Flags
>
> NULL, // Context
> Callbacks, // Operation callbacks
>
> PtUnload, // MiniFilterUnload
>
> PtInstanceSetup, // InstanceSetup
> PtInstanceQueryTeardown, // InstanceQueryTeardown
> PtInstanceTeardownStart, // InstanceTeardownStart
> PtInstanceTeardownComplete, // InstanceTeardownComplete
>
> GenerateFileNameCallback, // GenerateFileName
> NULL, // GenerateDestinationFileName
> NULL // NormalizeNameComponent
>
> };
>
> Thanks
>
> BEN
>

Thanks Rod.

Just for curious, what is “WAG”?

I searched around i can’t find the checked version of fltmgr, where can i download it?

Thanks
Ben

http://www.acronymfinder.com/WAG.html

There are several meanings for WAG. I believe he was using definition #2 in this list.

It’s the lesser cousin of a SWAG.

WAG being a “wild ass guess” then the superior SWAG would be a “Scientific
Wild Ass Guess”.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, September 30, 2010 7:56 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Register name provider failed

Thanks Rod.

Just for curious, what is “WAG”?

I searched around i can’t find the checked version of fltmgr, where can i
download it?

Thanks
Ben


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

> I searched around i can’t find the checked version of fltmgr, where can i

download it?

You need to download the DVD of the checked build from MSDN and unpick it.
NT Insider have a great article on doing this (and installing the checked
HAL & Kernel) but it was for XP and earlier and has rotted badly (hint hint)

Indeed.

Roughly:

1.) Download the chk build of your target os
2.) Download the WAIK
3.) Either burn the chk iso or use some sort of virtual cd (osronline has
one) to mount it. For our purposes here, let’s assume that you’ve mounted
it as ‘Z:.’
4.) Install the WAIK
5.) From the start menu, under ‘WAIK,’ start the ‘WAIK command prompt.’ Be
sure to run it as Administrator (which I don’t believe that it does on its
own).
6.) Make a directory somewhere to use as a mount point. Let’s assume
you’ve called it ‘c:\mnt.’
7.) imagex /MOUNT z:\sources\install.wim 1 c:\mnt
8.) cd /D c:\mnt
9.) You should now be looking at a windows installation directory. Get
whatever you need from ‘Windows,’ ‘Windows\System32,’
‘Windows\System32\Drivers,’ or wherever. Be advised that some files are not
where they are normally found on a live system, but in some mangled
directory name under ‘packages.’ For example, ‘acpi.sys.’ If you can’t
find something, just perform some sort of wildcard search (i. e. - 'dir /s
/b ‘*acpi’) under ‘packages.’
10. When you’re all done, issue ‘imagex /UNMOUNT c:\mnt.’

Good luck,

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rod Widdowson
Sent: Friday, October 01, 2010 4:18 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Register name provider failed

I searched around i can’t find the checked version of fltmgr, where can i
download it?

You need to download the DVD of the checked build from MSDN and unpick it.
NT Insider have a great article on doing this (and installing the checked
HAL & Kernel) but it was for XP and earlier and has rotted badly (hint hint)


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer