Rename destination path problem

NTFSD
1

860543ec 5c 00 3f 00 3f 00 5c 00 41 00 3a 00 5c 00 4a 00 .?.?..A.:..J.
860543fc 65 00 72 00 65 00 6d 00 79 00 00 00 00 00 00 00 e.r.e.m.y…

That is, “??\A:\Jeremy”.

That’s what I’m getting for the destination path of a rename (FileName
member of _FILE_RENAME_INFORMATION). I expected “\Jeremy”. The
RootDirectory member of the _FILE_RENAME_INFORMATION struct is null, and
ReplaceIfExists is 0. FileNameLength is 1a, which is 13 characters, so that
lines up with the string I’m getting. Does anyone know where the ??\a:
part came from, and how I should interpret paths like that in the future?
I’m using a floppy, so the drive letter is a, but I’ve never seen a drive
letter or the ?? in any other path string input. The source path is \New
folder. This happens when I right-click and select new folder, then type
‘Jeremy’ and hit enter in Windows Explorer.

Thanks,
Jeremy

2

In this case (there are 3 possible), the target name is constructed by using
the irpSp->Parameters.SetFile.FileObject for the target directory and the
leaf name string found in the buffer.

I believe there is an OSR white paper (perhaps out-of-date) that describes
how to obtain a rename target.

/ted

PS: The "??" part is the short-hand notation for "\DosDevices" which in
turn identifies the A: as a symbolic link. However, in this example, it can
be ignored.

-----Original Message-----
From: Jeremy Sherrill [mailto:xxxxx@datalight.com]
Sent: Wednesday, February 04, 2004 3:35 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Rename destination path problem

860543ec 5c 00 3f 00 3f 00 5c 00 41 00 3a 00 5c 00 4a 00 .?.?..A.:..J.
860543fc 65 00 72 00 65 00 6d 00 79 00 00 00 00 00 00 00 e.r.e.m.y…

That is, “??\A:\Jeremy”.

That’s what I’m getting for the destination path of a rename (FileName
member of _FILE_RENAME_INFORMATION). I expected “\Jeremy”. The
RootDirectory member of the _FILE_RENAME_INFORMATION struct is null, and
ReplaceIfExists is 0. FileNameLength is 1a, which is 13 characters, so that
lines up with the string I’m getting. Does anyone know where the ??\a:
part came from, and how I should interpret paths like that in the future?
I’m using a floppy, so the drive letter is a, but I’ve never seen a drive
letter or the ?? in any other path string input. The source path is \New
folder. This happens when I right-click and select new folder, then type
‘Jeremy’ and hit enter in Windows Explorer.

Thanks,
Jeremy

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

When you have a rename where the new name is a fully qualified path
(that’s what you’ve got here), the name must be in a format that is
legal to be passed to IoCreateFile, therefore it must begin with a
device name which is the “??\A:” part.

When a rename occurs, the IO Manager must first open the parent
directory of the new name to ensure that the user issuing the rename has
sufficient access to add a child to the new parent directory. The name
the IO Manager uses when opening the parent directory is exactly the
name specified in the FILE_RENAME_INFORMATION buffer and then is uses
the flag IO_OPEN_TARGET_DIRECTORY to specify to the file system that the
parent directory of the name specified should be opened.

When you see hardlinks create (IRP_MJ_SET_INFORMATION,
FileLinkInformation), the fully specified target name will also be in
this format.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Sherrill
Sent: Wednesday, February 04, 2004 12:35 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Rename destination path problem

860543ec 5c 00 3f 00 3f 00 5c 00 41 00 3a 00 5c 00 4a 00
.?.?..A.:..J.
860543fc 65 00 72 00 65 00 6d 00 79 00 00 00 00 00 00 00
e.r.e.m.y…

That is, “??\A:\Jeremy”.

That’s what I’m getting for the destination path of a rename (FileName
member of _FILE_RENAME_INFORMATION). I expected “\Jeremy”. The
RootDirectory member of the _FILE_RENAME_INFORMATION struct is null, and
ReplaceIfExists is 0. FileNameLength is 1a, which is 13 characters, so
that lines up with the string I’m getting. Does anyone know where the
??\a:
part came from, and how I should interpret paths like that in the
future?
I’m using a floppy, so the drive letter is a, but I’ve never seen a
drive letter or the ?? in any other path string input. The source path
is \New folder. This happens when I right-click and select new folder,
then type ‘Jeremy’ and hit enter in Windows Explorer.

Thanks,
Jeremy

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> When you see hardlinks create (IRP_MJ_SET_INFORMATION,

FileLinkInformation), the fully specified target name will also be in
this format

I only add a note that the IRP_MJ_CREATE request may contain
the file name in this format too.

L.

5

If you tried to opened a file with the name “??\a:??\a:\jeremy”, you
would see the name “??\a:\jeremy” come down in the CREATE path, but the
operation would fail because this is not a well-formed name and it is
the file system that will detect this naming error.

If you tried to open “??\a:\jeremy”, the name you will see in CREATE
should be “\jeremy”.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Wednesday, February 04, 2004 10:43 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Rename destination path problem

When you see hardlinks create (IRP_MJ_SET_INFORMATION,
FileLinkInformation), the fully specified target name will also be in
this format

I only add a note that the IRP_MJ_CREATE request may contain the file
name in this format too.

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Thanks everybody, I understand now.

“Jeremy Sherrill” wrote in message
news:xxxxx@ntfsd…
> 860543ec 5c 00 3f 00 3f 00 5c 00 41 00 3a 00 5c 00 4a 00 .?.?..A.:..J.
> 860543fc 65 00 72 00 65 00 6d 00 79 00 00 00 00 00 00 00 e.r.e.m.y…
>
> That is, “??\A:\Jeremy”.
>
> That’s what I’m getting for the destination path of a rename (FileName
> member of _FILE_RENAME_INFORMATION). I expected “\Jeremy”. The
> RootDirectory member of the _FILE_RENAME_INFORMATION struct is null, and
> ReplaceIfExists is 0. FileNameLength is 1a, which is 13 characters, so
that
> lines up with the string I’m getting. Does anyone know where the ??\a:
> part came from, and how I should interpret paths like that in the future?
> I’m using a floppy, so the drive letter is a, but I’ve never seen a drive
> letter or the ?? in any other path string input. The source path is \New
> folder. This happens when I right-click and select new folder, then type
> ‘Jeremy’ and hit enter in Windows Explorer.
>
> Thanks,
> Jeremy
>
>
>