Rename default stream to ADS

NTFSD
1

Hi all,

I’m working on a filter driver that redirects data from a default stream to
an ADS, however I’ve hit a problem with renames. The approach I’m taking is
very similar to that in the NameChanger sample in the WDK. For simplicity
I’m currently using a simple rename, I’ll move onto fully qualified and
relative once I have this working.

Assuming I’m renaming “Z:\original_folder\original_file.txt” to
“Z:\original_folder\new_file.txt”
In my pre-op for SetInfo, I build up a new buffer which contains
“Z:\original_folder\new_file.txt:mystream”. I then create a new
FILE_RENAME_INFORMATION struct which contains the new buffer with the ADS,
then call FltSetInformationFile and the complete the pre-op.

With the ADS tagged on I get STATUS_OBJECT_NAME_INVALID, however if I use
exactly the same code but reduce the FileNameLength in the
FILE_RENAME_INFORMATION struct to remove the ADS, it works fine.

So my questions are:

  • Why am I receiving STATUS_OBJECT_NAME_INVALID?
  • Is it possible to rename from “Z:\original_folder\original_file.txt” to
    “Z:\original_folder\new_file.txt:mystream”?
  • Are there any extra steps I need to take above a normal rename?

Thanks,
Ged.

2

I’m not sure what you are trying to accomplish, just rename the file and
your ADS will remain associated to the file with the new name. The
reason you are getting back the error you describe makes sense in that
you are telling the file system to rename a particular name of a
particular data stream of the file, what about the other attributes of
the original file? And the default data stream?

Pete

On 3/11/2014 10:22 AM, Ged Murphy wrote:

Hi all,

I’m working on a filter driver that redirects data from a default stream to
an ADS, however I’ve hit a problem with renames. The approach I’m taking is
very similar to that in the NameChanger sample in the WDK. For simplicity
I’m currently using a simple rename, I’ll move onto fully qualified and
relative once I have this working.

Assuming I’m renaming “Z:\original_folder\original_file.txt” to
“Z:\original_folder\new_file.txt”
In my pre-op for SetInfo, I build up a new buffer which contains
“Z:\original_folder\new_file.txt:mystream”. I then create a new
FILE_RENAME_INFORMATION struct which contains the new buffer with the ADS,
then call FltSetInformationFile and the complete the pre-op.

With the ADS tagged on I get STATUS_OBJECT_NAME_INVALID, however if I use
exactly the same code but reduce the FileNameLength in the
FILE_RENAME_INFORMATION struct to remove the ADS, it works fine.

So my questions are:

  • Why am I receiving STATUS_OBJECT_NAME_INVALID?
  • Is it possible to rename from “Z:\original_folder\original_file.txt” to
    “Z:\original_folder\new_file.txt:mystream”?
  • Are there any extra steps I need to take above a normal rename?

Thanks,
Ged.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

3

Ahh, it seems I’m looking at this incorrectly. I’m thinking more along the
line of stream renames rather than file renames, which I think is what’s
throwing me.

I’ll try to give a different example of what I meant. The following scenario
happens without my driver loaded:

Let’s say I’ve opened an ADS using FileTest called “Z:\myfile.txt:mystream”
and then try to rename that file to “z:\mynewfile.txt”.
If I try to rename it to either “z:\mynewfile.txt” or
“z:\mynewfile.txt:mystream”, both calls will fail with
STATUS_INVALID_PARAMETER.

Can I therefore deduce that it’s not possible to rename a file whenever an
ADS is involved, whether that ADS be linked the source or destination?

In this scenario, I’m assuming would I need to do the following:

  • use a filter driver to detect that an ADS rename is present
  • build up a new string path without the ADS
  • Call FltCreateFileEx2 to get a file object without the ADS
  • Do the rename on that file object
  • complete the pre-op

My driver does a lot of redirecting of data to ADS, so I really need to get
this right in my head before I’m happy :slight_smile:

Thanks

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: 11 March 2014 16:35
To: Windows File Systems Devs Interest List
Cc: xxxxx@KernelDrivers.com
Subject: Re: [ntfsd] Rename default stream to ADS

I’m not sure what you are trying to accomplish, just rename the file and
your ADS will remain associated to the file with the new name. The reason
you are getting back the error you describe makes sense in that you are
telling the file system to rename a particular name of a particular data
stream of the file, what about the other attributes of the original file?
And the default data stream?

Pete

On 3/11/2014 10:22 AM, Ged Murphy wrote:

Hi all,

I’m working on a filter driver that redirects data from a default stream
to
an ADS, however I’ve hit a problem with renames. The approach I’m taking
is
very similar to that in the NameChanger sample in the WDK. For simplicity
I’m currently using a simple rename, I’ll move onto fully qualified and
relative once I have this working.

Assuming I’m renaming “Z:\original_folder\original_file.txt” to
“Z:\original_folder\new_file.txt”
In my pre-op for SetInfo, I build up a new buffer which contains
“Z:\original_folder\new_file.txt:mystream”. I then create a new
FILE_RENAME_INFORMATION struct which contains the new buffer with the ADS,
then call FltSetInformationFile and the complete the pre-op.

With the ADS tagged on I get STATUS_OBJECT_NAME_INVALID, however if I use
exactly the same code but reduce the FileNameLength in the
FILE_RENAME_INFORMATION struct to remove the ADS, it works fine.

So my questions are:

  • Why am I receiving STATUS_OBJECT_NAME_INVALID?
  • Is it possible to rename from “Z:\original_folder\original_file.txt” to
    “Z:\original_folder\new_file.txt:mystream”?
  • Are there any extra steps I need to take above a normal rename?

Thanks,
Ged.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Without fully understanding your code flow something does spring out at me -
are you making any use of the targetFileObject ?

I have certainly done stream rename from within a filter and encountered no
problems. You may need to be slight careful when renaming a stream to
::$DATA$ because some other subsystems might get confused about the
StreamContexts (I have encountered some that treated the Stream Context for
::$DATA as being a File Context). Unfortunately I cannot remember any more
details - except that I did have some issues.

5

In my code, I do make use of FltGetDestinationFileNameInformation and
FltGetFileNameInformation, but I don’t access targetFileObject directly.

However the previous example I gave is using a vanilla install, anyone can
see the error just using FileTest and FileSpy

Ged

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rod Widdowson
Sent: 11 March 2014 17:56
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Rename default stream to ADS

Without fully understanding your code flow something does spring out at me -
are you making any use of the targetFileObject ?

I have certainly done stream rename from within a filter and encountered no
problems. You may need to be slight careful when renaming a stream to
::$DATA$ because some other subsystems might get confused about the
StreamContexts (I have encountered some that treated the Stream Context for
::$DATA as being a File Context). Unfortunately I cannot remember any more
details - except that I did have some issues.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Hi Rod,

Are you sure you managed to rename a file using a file handle which was
opened with an ADS?

I’ve been playing with FileTest for a while now, and whenever there’s an ADS
involved (whether the original file object or the requested renamed object),
I always get a STATUS_INVALID_PARAMETER.

I’m starting to think renames are only possible when working with default
streams.

Ged.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rod Widdowson
Sent: 11 March 2014 17:56
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Rename default stream to ADS

Without fully understanding your code flow something does spring out at me -
are you making any use of the targetFileObject ?

I have certainly done stream rename from within a filter and encountered no
problems. You may need to be slight careful when renaming a stream to
::$DATA$ because some other subsystems might get confused about the
StreamContexts (I have encountered some that treated the Stream Context for
::$DATA as being a File Context). Unfortunately I cannot remember any more
details - except that I did have some issues.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

Ged,

I can confirm that having a file, call it foo.dat, with an ADS, call it
:mystream, that when I rename foo.dat to bar.dat, I am still able to
access bar.dat:mystream without issue. And the rename is processed normally.

That said, I don’t attempt to open the ADS :mystream and perform a
rename on that file object, I allow the open on foo.dat and rename using
that file object.

As well, I have not encountered a scenario where an ADS is opened and a
rename occurs on that file object. I would guess that is not allowed,
how would the file system deal with the other streams and attributes of
the file.

Pete

On 3/11/2014 11:37 AM, Ged Murphy wrote:

Ahh, it seems I’m looking at this incorrectly. I’m thinking more along the
line of stream renames rather than file renames, which I think is what’s
throwing me.

I’ll try to give a different example of what I meant. The following scenario
happens without my driver loaded:

Let’s say I’ve opened an ADS using FileTest called “Z:\myfile.txt:mystream”
and then try to rename that file to “z:\mynewfile.txt”.
If I try to rename it to either “z:\mynewfile.txt” or
“z:\mynewfile.txt:mystream”, both calls will fail with
STATUS_INVALID_PARAMETER.

Can I therefore deduce that it’s not possible to rename a file whenever an
ADS is involved, whether that ADS be linked the source or destination?

In this scenario, I’m assuming would I need to do the following:

  • use a filter driver to detect that an ADS rename is present
  • build up a new string path without the ADS
  • Call FltCreateFileEx2 to get a file object without the ADS
  • Do the rename on that file object
  • complete the pre-op

My driver does a lot of redirecting of data to ADS, so I really need to get
this right in my head before I’m happy :slight_smile:

Thanks

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: 11 March 2014 16:35
To: Windows File Systems Devs Interest List
Cc: xxxxx@KernelDrivers.com
Subject: Re: [ntfsd] Rename default stream to ADS

I’m not sure what you are trying to accomplish, just rename the file and
your ADS will remain associated to the file with the new name. The reason
you are getting back the error you describe makes sense in that you are
telling the file system to rename a particular name of a particular data
stream of the file, what about the other attributes of the original file?
And the default data stream?

Pete

On 3/11/2014 10:22 AM, Ged Murphy wrote:
> Hi all,
>
> I’m working on a filter driver that redirects data from a default stream
to
> an ADS, however I’ve hit a problem with renames. The approach I’m taking
is
> very similar to that in the NameChanger sample in the WDK. For simplicity
> I’m currently using a simple rename, I’ll move onto fully qualified and
> relative once I have this working.
>
> Assuming I’m renaming “Z:\original_folder\original_file.txt” to
> “Z:\original_folder\new_file.txt”
> In my pre-op for SetInfo, I build up a new buffer which contains
> “Z:\original_folder\new_file.txt:mystream”. I then create a new
> FILE_RENAME_INFORMATION struct which contains the new buffer with the ADS,
> then call FltSetInformationFile and the complete the pre-op.
>
> With the ADS tagged on I get STATUS_OBJECT_NAME_INVALID, however if I use
> exactly the same code but reduce the FileNameLength in the
> FILE_RENAME_INFORMATION struct to remove the ADS, it works fine.
>
> So my questions are:
> - Why am I receiving STATUS_OBJECT_NAME_INVALID?
> - Is it possible to rename from “Z:\original_folder\original_file.txt” to
> “Z:\original_folder\new_file.txt:mystream”?
> - Are there any extra steps I need to take above a normal rename?
>
> Thanks,
> Ged.
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

8

Hi Pete,

Yep, I see exactly the same behaviour as you do.

The scenario you talk about never having encountered is actually forced by
my driver. For certain processes, I reparse all file creates to an ADS
without the callers knowledge. This means any renames done on a file by this
process will inadvertently be on the ADS instead of the default file object.

It looks like I’m going to have to handle renames for ADS internally in my
filter by reopening the files without the ADS, doing the rename and
completing the pre-op.

A job for tomorrow.

Thanks,
Ged.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: 11 March 2014 22:18
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Rename default stream to ADS

Ged,

I can confirm that having a file, call it foo.dat, with an ADS, call it
:mystream, that when I rename foo.dat to bar.dat, I am still able to access
bar.dat:mystream without issue. And the rename is processed normally.

That said, I don’t attempt to open the ADS :mystream and perform a rename on
that file object, I allow the open on foo.dat and rename using that file
object.

As well, I have not encountered a scenario where an ADS is opened and a
rename occurs on that file object. I would guess that is not allowed, how
would the file system deal with the other streams and attributes of the
file.

Pete

On 3/11/2014 11:37 AM, Ged Murphy wrote:

Ahh, it seems I’m looking at this incorrectly. I’m thinking more
along the line of stream renames rather than file renames, which I
think is what’s throwing me.

I’ll try to give a different example of what I meant. The following
scenario happens without my driver loaded:

Let’s say I’ve opened an ADS using FileTest called
“Z:\myfile.txt:mystream”
and then try to rename that file to “z:\mynewfile.txt”.
If I try to rename it to either “z:\mynewfile.txt” or
“z:\mynewfile.txt:mystream”, both calls will fail with
STATUS_INVALID_PARAMETER.

Can I therefore deduce that it’s not possible to rename a file
whenever an ADS is involved, whether that ADS be linked the source or
destination?

In this scenario, I’m assuming would I need to do the following:

  • use a filter driver to detect that an ADS rename is present
  • build up a new string path without the ADS
  • Call FltCreateFileEx2 to get a file object without the ADS
  • Do the rename on that file object
  • complete the pre-op

My driver does a lot of redirecting of data to ADS, so I really need
to get this right in my head before I’m happy :slight_smile:

Thanks

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: 11 March 2014 16:35
To: Windows File Systems Devs Interest List
Cc: xxxxx@KernelDrivers.com
Subject: Re: [ntfsd] Rename default stream to ADS

I’m not sure what you are trying to accomplish, just rename the file
and your ADS will remain associated to the file with the new name. The
reason you are getting back the error you describe makes sense in that
you are telling the file system to rename a particular name of a
particular data stream of the file, what about the other attributes of the
original file?
And the default data stream?

Pete

On 3/11/2014 10:22 AM, Ged Murphy wrote:
> Hi all,
>
> I’m working on a filter driver that redirects data from a default
> stream
to
> an ADS, however I’ve hit a problem with renames. The approach I’m
> taking
is
> very similar to that in the NameChanger sample in the WDK. For
> simplicity I’m currently using a simple rename, I’ll move onto fully
> qualified and relative once I have this working.
>
> Assuming I’m renaming “Z:\original_folder\original_file.txt” to
> “Z:\original_folder\new_file.txt”
> In my pre-op for SetInfo, I build up a new buffer which contains
> “Z:\original_folder\new_file.txt:mystream”. I then create a new
> FILE_RENAME_INFORMATION struct which contains the new buffer with the
> ADS, then call FltSetInformationFile and the complete the pre-op.
>
> With the ADS tagged on I get STATUS_OBJECT_NAME_INVALID, however if I
> use exactly the same code but reduce the FileNameLength in the
> FILE_RENAME_INFORMATION struct to remove the ADS, it works fine.
>
> So my questions are:
> - Why am I receiving STATUS_OBJECT_NAME_INVALID?
> - Is it possible to rename from
> “Z:\original_folder\original_file.txt” to
“Z:\original_folder\new_file.txt:mystream”?
> - Are there any extra steps I need to take above a normal rename?
>
> Thanks,
> Ged.
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting www.KernelDrivers.com
866.263.9295

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Ged,

No, what you are trying to do it not valid. Take a look at
http://msdn.microsoft.com/en-us/library/windows/hardware/ff540344(v=vs.85%
29.aspx

  • Danilo
10

I can’t believe I missed that.
Thanks for pointing it out Danilo, everything makes sense now :slight_smile:

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Danilo Almeida
Sent: 12 March 2014 02:54
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Rename default stream to ADS

Ged,

No, what you are trying to do it not valid. Take a look at
http://msdn.microsoft.com/en-us/library/windows/hardware/ff540344(v=vs.85%
29.aspx

  • Danilo

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer