I’m going to take a guess at this one – I’ve seen enough cases in my own
filters of getting file names wrong over the years, that I think I know what
is happening here. Anyway here goes…
You mentioned that the FileObject in RelatedFileObject was “logged” as a
volume file object. How are you determining that it was a volume FO? It
could have been the “root” of the share ("") and you missed getting the
correct name for it by using its ReleatedFileObject.
I determine a FO to be a volume FO if the following is TRUE:
if ((fileObject->FileName.Length == 0) &&
(fileObject->RelatedFileObject == NULL))
Otherwise, it’s not a volume open.
I will use the RelatedFileObject (if non-NULL) only if the following is
TRUE:
if ((fileObject->FileName.Length == 0) ||
(fileObject->FileName.Buffer[0] != L’\'))
Otherwise, ignore the RelatedFileObject.
If when you are all done and you have a zero-length name then it is the root
directory of the device and stil not a volume FO.
All I can say is this has worked well for me – others may disagree or have
other techniques.
/ted
-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@alfasp.com]
Sent: Wednesday, December 17, 2003 3:00 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RelatedFileObject during IRP_MJ_CREATE
'till recently (today:-), to get the file name from a file object in
IRP_MJ_CREATE, I looked up the RelatedFileObject in the hash table (or
queried if not present), and appended it before FileObject file name.
Well, during one situation I got a problem with this approach - copying
over a to a shared folder inside the root of a disk. Say C:\Secret is shared
(LOL) as Secret, copying to \Server\Secret should cause
C:\Secret\FileName.ext to be the resulting file name.
Instead I get C:\FileName.ext - a bit of tracing reveals that
RelatedFileObject was logged as volume file object…
I’d rather leave the obvious (fault in the implementation of the
algorithm) as the last resort:-)
Filter is based on SFilter, boot time load, monitoring all file systems
that register via IoRegisterFsRegistration change as well as Novell drives.
Am I doing it wrong?
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services. Alfa
File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com