RelatedFileObject

Hi everybody,
I want to get the full name of the file is being opened when a create call is intercepted. I get the name from FileObject field in the stacklocation. If the name doesn’t start with a backslash then I get the name of the RelatedFileObject and concatenate this to names. This way I get the name with full path included. I am looking only one RelatedFileObject up. Do I have to keep looking up while there are RelatedFileObjects? Or one is enough?
Thanks.

The best way to do this is to send down IRP_MJ_QUERY_INFORMATION with
FileNameInformation (using your own IRP) on the file object after the
open has been sent down. This lets you avoid the headache of
constructing the pathname yourself from the file object fields yourself
(which has numerous limitations and gotchas).

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ratmil Torres
Sent: Thursday, October 31, 2002 1:34 PM
To: File Systems Developers
Subject: [ntfsd] RelatedFileObject

Hi everybody,
I want to get the full name of the file is being opened when a create
call is intercepted. I get the name from FileObject field in the
stacklocation. If the name doesn’t start with a backslash then I get the
name of the RelatedFileObject and concatenate this to names. This way I
get the name with full path included. I am looking only one
RelatedFileObject up. Do I have to keep looking up while there are
RelatedFileObjects? Or one is enough?
Thanks.

You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%

It is best to query the FSD for the canonical name and not worry about
chaining the RFOs. Since the RO is post-create, the name can be invalid.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ratmil Torres
Sent: Thursday, October 31, 2002 1:34 PM
To: File Systems Developers
Subject: [ntfsd] RelatedFileObject

Hi everybody,

I want to get the full name of the file is being opened when a create
call is intercepted. I get the name from FileObject field in the
stacklocation. If the name doesn’t start with a backslash then I get the
name of the RelatedFileObject and concatenate this to names. This way I
get the name with full path included. I am looking only one
RelatedFileObject up. Do I have to keep looking up while there are
RelatedFileObjects? Or one is enough?

Thanks.


You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

Yep, only one related file object.
----- Original Message -----
From: Ratmil Torres
To: File Systems Developers
Sent: Thursday, October 31, 2002 11:33 PM
Subject: [ntfsd] RelatedFileObject

Hi everybody,
I want to get the full name of the file is being opened when a create call is intercepted. I get the name from FileObject field in the stacklocation. If the name doesn’t start with a backslash then I get the name of the RelatedFileObject and concatenate this to names. This way I get the name with full path included. I am looking only one RelatedFileObject up. Do I have to keep looking up while there are RelatedFileObjects? Or one is enough?
Thanks.

You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%

I believe your test is backwards. You should test to see if the related file object field is non-NULL and query for the name if so. Then when you concatenate the strings together you should insert a backslash only if you need one.

Remember, it is only valid to look at the related file object field during pre-IRP_MJ_CREATE processing.

Neal Christiansen
Microsoft File System Filter Group

This posting is provided “AS IS” with no warranties, and confers no rights.

-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Thursday, October 31, 2002 2:19 PM
To: File Systems Developers
Subject: [ntfsd] Re: RelatedFileObject

Yep, only one related file object.
----- Original Message -----
From: Ratmil Torres
To: File Systems Developers
Sent: Thursday, October 31, 2002 11:33 PM
Subject: [ntfsd] RelatedFileObject

Hi everybody,
I want to get the full name of the file is being opened when a create call is intercepted. I get the name from FileObject field in the stacklocation. If the name doesn’t start with a backslash then I get the name of the RelatedFileObject and concatenate this to names. This way I get the name with full path included. I am looking?only one RelatedFileObject up. Do I have to keep looking up while there are RelatedFileObjects? Or one is enough?
Thanks.

You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to %%email.unsub%%

I’ve seen lots of allusions on this list to problems
with getting the file name this way. Are there
problems other than when the file is opened by ID?

Also, how often are files opened by ID? What kind of
programs do this?

— Neal Christiansen
wrote:
> I believe your test is backwards. You should test
> to see if the related file object field is non-NULL
> and query for the name if so. Then when you
> concatenate the strings together you should insert a
> backslash only if you need one.
>
> Remember, it is only valid to look at the related
> file object field during pre-IRP_MJ_CREATE
> processing.
>
> Neal Christiansen
> Microsoft File System Filter Group
>
> This posting is provided “AS IS” with no warranties,
> and confers no rights.
>
>
> -----Original Message-----
> From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> Sent: Thursday, October 31, 2002 2:19 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: RelatedFileObject
>
> Yep, only one related file object.
> ----- Original Message -----
> From: Ratmil Torres
> To: File Systems Developers
> Sent: Thursday, October 31, 2002 11:33 PM
> Subject: [ntfsd] RelatedFileObject
>
> Hi everybody,
> I want to get the full name of the file is being
> opened when a create call is intercepted. I get the
> name from FileObject field in the stacklocation. If
> the name doesn’t start with a backslash then I get
> the name of the RelatedFileObject and concatenate
> this to names. This way I get the name with full
> path included. I am looking only one
> RelatedFileObject up. Do I have to keep looking up
> while there are RelatedFileObjects? Or one is
> enough?
> Thanks.
> —
> You are currently subscribed to ntfsd as:
> xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@Windows.Microsoft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%

__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

Thanks, a lot to all of you.
That’s my case, I get the name before passing down a RIP_MJ_CREATE.
----- Original Message -----
From: “Neal Christiansen”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 7:24 AM
Subject: [ntfsd] Re: RelatedFileObject

> I believe your test is backwards. You should test to see if the related
file object field is non-NULL and query for the name if so. Then when you
concatenate the strings together you should insert a backslash only if you
need one.
>
> Remember, it is only valid to look at the related file object field during
pre-IRP_MJ_CREATE processing.
>
> Neal Christiansen
> Microsoft File System Filter Group
>
> This posting is provided “AS IS” with no warranties, and confers no
rights.
>
>
> -----Original Message-----
> From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> Sent: Thursday, October 31, 2002 2:19 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: RelatedFileObject
>
> Yep, only one related file object.
> ----- Original Message -----
> From: Ratmil Torres
> To: File Systems Developers
> Sent: Thursday, October 31, 2002 11:33 PM
> Subject: [ntfsd] RelatedFileObject
>
> Hi everybody,
> I want to get the full name of the file is being opened when a create call
is intercepted. I get the name from FileObject field in the stacklocation.
If the name doesn’t start with a backslash then I get the name of the
RelatedFileObject and concatenate this to names. This way I get the name
with full path included. I am looking only one RelatedFileObject up. Do I
have to keep looking up while there are RelatedFileObjects? Or one is
enough?
> Thanks.
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
> —
> You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@seg.inf.cu
> To unsubscribe send a blank email to %%email.unsub%%
>

Some NFS servers for NT’s are using file IDs to open files.
WBR Primoz

-----Original Message-----
From: Randy Cook [mailto:xxxxx@yahoo.com]
Sent: Friday, November 01, 2002 5:26 PM
To: File Systems Developers
Subject: [ntfsd] Re: RelatedFileObject

I’ve seen lots of allusions on this list to problems
with getting the file name this way. Are there
problems other than when the file is opened by ID?

Also, how often are files opened by ID? What kind of
programs do this?

— Neal Christiansen
wrote:
> I believe your test is backwards. You should test
> to see if the related file object field is non-NULL
> and query for the name if so. Then when you
> concatenate the strings together you should insert a backslash only if
> you need one.
>
> Remember, it is only valid to look at the related
> file object field during pre-IRP_MJ_CREATE
> processing.
>
> Neal Christiansen
> Microsoft File System Filter Group
>
> This posting is provided “AS IS” with no warranties,
> and confers no rights.
>
>
> -----Original Message-----
> From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> Sent: Thursday, October 31, 2002 2:19 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: RelatedFileObject
>
> Yep, only one related file object.
> ----- Original Message -----
> From: Ratmil Torres
> To: File Systems Developers
> Sent: Thursday, October 31, 2002 11:33 PM
> Subject: [ntfsd] RelatedFileObject
>
> Hi everybody,
> I want to get the full name of the file is being
> opened when a create call is intercepted. I get the
> name from FileObject field in the stacklocation. If
> the name doesn’t start with a backslash then I get
> the name of the RelatedFileObject and concatenate
> this to names. This way I get the name with full
> path included. I am looking?only one
> RelatedFileObject up. Do I have to keep looking up
> while there are RelatedFileObjects? Or one is
> enough?
> Thanks.
> —
> You are currently subscribed to ntfsd as:
> xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>
> —
> You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yahoo.com To
> unsubscribe send a blank email to
%%email.unsub%%

__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/


You are currently subscribed to ntfsd as: xxxxx@hermes.si To
unsubscribe send a blank email to %%email.unsub%%

Then I can’t get filename from FileObject?
----- Original Message -----
From: “Primoz Beltram”
To: “File Systems Developers”
Sent: Monday, November 04, 2002 11:31 PM
Subject: [ntfsd] Re: RelatedFileObject

> Some NFS servers for NT’s are using file IDs to open files.
> WBR Primoz
>
> -----Original Message-----
> From: Randy Cook [mailto:xxxxx@yahoo.com]
> Sent: Friday, November 01, 2002 5:26 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: RelatedFileObject
>
>
> I’ve seen lots of allusions on this list to problems
> with getting the file name this way. Are there
> problems other than when the file is opened by ID?
>
> Also, how often are files opened by ID? What kind of
> programs do this?
>
> — Neal Christiansen
> wrote:
> > I believe your test is backwards. You should test
> > to see if the related file object field is non-NULL
> > and query for the name if so. Then when you
> > concatenate the strings together you should insert a backslash only if
> > you need one.
> >
> > Remember, it is only valid to look at the related
> > file object field during pre-IRP_MJ_CREATE
> > processing.
> >
> > Neal Christiansen
> > Microsoft File System Filter Group
> >
> > This posting is provided “AS IS” with no warranties,
> > and confers no rights.
> >
> >
> > -----Original Message-----
> > From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> > Sent: Thursday, October 31, 2002 2:19 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Re: RelatedFileObject
> >
> > Yep, only one related file object.
> > ----- Original Message -----
> > From: Ratmil Torres
> > To: File Systems Developers
> > Sent: Thursday, October 31, 2002 11:33 PM
> > Subject: [ntfsd] RelatedFileObject
> >
> > Hi everybody,
> > I want to get the full name of the file is being
> > opened when a create call is intercepted. I get the
> > name from FileObject field in the stacklocation. If
> > the name doesn’t start with a backslash then I get
> > the name of the RelatedFileObject and concatenate
> > this to names. This way I get the name with full
> > path included. I am looking only one
> > RelatedFileObject up. Do I have to keep looking up
> > while there are RelatedFileObjects? Or one is
> > enough?
> > Thanks.
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yahoo.com To
> > unsubscribe send a blank email to
> %%email.unsub%%
>
>
> __________________________________________________
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@hermes.si To
> unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@seg.inf.cu
> To unsubscribe send a blank email to %%email.unsub%%
>

Yes, but note that FileObject must be “valid” (create completion or
post-create operations). If you need a “readable” filename in your FSFD,
before create is completed, then you can run your own ZwOpenFile(…,
|FILE_OPEN_BY_FILE_ID); and
ZwQueryInformationFile(…,FileNameInformation);. Use worker threads.
WBR Primoz

-----Original Message-----
From: Ratmil Torres [mailto:xxxxx@seg.inf.cu]
Sent: Tuesday, November 05, 2002 10:31 PM
To: File Systems Developers
Subject: [ntfsd] Re: RelatedFileObject

Then I can’t get filename from FileObject?
----- Original Message -----
From: “Primoz Beltram”
To: “File Systems Developers”
Sent: Monday, November 04, 2002 11:31 PM
Subject: [ntfsd] Re: RelatedFileObject

> Some NFS servers for NT’s are using file IDs to open files.
> WBR Primoz
>
> -----Original Message-----
> From: Randy Cook [mailto:xxxxx@yahoo.com]
> Sent: Friday, November 01, 2002 5:26 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: RelatedFileObject
>
>
> I’ve seen lots of allusions on this list to problems
> with getting the file name this way. Are there
> problems other than when the file is opened by ID?
>
> Also, how often are files opened by ID? What kind of programs do
> this?
>
> — Neal Christiansen
> wrote:
> > I believe your test is backwards. You should test
> > to see if the related file object field is non-NULL
> > and query for the name if so. Then when you
> > concatenate the strings together you should insert a backslash only
> > if you need one.
> >
> > Remember, it is only valid to look at the related
> > file object field during pre-IRP_MJ_CREATE
> > processing.
> >
> > Neal Christiansen
> > Microsoft File System Filter Group
> >
> > This posting is provided “AS IS” with no warranties,
> > and confers no rights.
> >
> >
> > -----Original Message-----
> > From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> > Sent: Thursday, October 31, 2002 2:19 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Re: RelatedFileObject
> >
> > Yep, only one related file object.
> > ----- Original Message -----
> > From: Ratmil Torres
> > To: File Systems Developers
> > Sent: Thursday, October 31, 2002 11:33 PM
> > Subject: [ntfsd] RelatedFileObject
> >
> > Hi everybody,
> > I want to get the full name of the file is being
> > opened when a create call is intercepted. I get the
> > name from FileObject field in the stacklocation. If
> > the name doesn’t start with a backslash then I get
> > the name of the RelatedFileObject and concatenate
> > this to names. This way I get the name with full
> > path included. I am looking only one
> > RelatedFileObject up. Do I have to keep looking up
> > while there are RelatedFileObjects? Or one is
> > enough?
> > Thanks.
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@Windows.Microsoft.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yahoo.com To
> > unsubscribe send a blank email to
> %%email.unsub%%
>
>
> __________________________________________________
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@hermes.si To
> unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@seg.inf.cu To
> unsubscribe send a blank email to %%email.unsub%%
>


You are currently subscribed to ntfsd as: xxxxx@hermes.si To
unsubscribe send a blank email to %%email.unsub%%