set file information (rename) on a directory

NTFSD
1

Hello all.

I’m trying to detect directory renames.

I hook the pre/post set information functions and check if a file renamed is a directory.

I observe two possible behaviors -
1.a pre set information is called on the directory

2.a pre set information is called on the directory AND THEN is called separately for each file in the directory

I can’t seem to find any logic why sometimes option 1 occurres and why sometimes 2.

I would like some kind of mechanism to make all directory renames to be of one of these option, consistently.

Something like a “directory op lock” could explain this behavior but I have found nothing while searching the documents.

Thanks,
Ariel

2

I would take a close look at exactly what it is setting on the files. Is it adjusting attributes, file times (what is the info level for the set)? This might give a clue as to why it happens when it does happen. It may also be useful to look at the call stack and determine where the calls are originating from.

3

Hi Rick.

In my previous post I meant that monitor all IRP_MJ_SET_INFORMATION callbacks with
FileInformationClass == FileRenameInformation (all other information classes seemed irrelevant).

Say I’m rename+moving c:\top\bottom, containing 1.txt, 2.doc etc.,
to c:\bottom, simply by means of ctrl+x and then ctrl+p in the windows explorer.

The volume is NTFS, if that matters somehow…

The rename operation in case 1 if only for the folder -
c:\top\bottom —> c:\bottom
and no more rename operations.
1.txt and 2.doc are magically moved and appear under c:\bottom
and on the second case:
c:\top\bottom —> c:\bottom
c:\top\bottom\1.txt —> c:\bottom\1.txt
c:\top\bottom\2.doc —> c:\bottom\2.doc

Is there some other callback I should set perhaps? any other documentation on directory rename+moving?

Ariel.

4

Are you seeing it change behavoir when you perform the rename the exact same way on the same set of directories? Explorer may be doing more than just a directory rename for some reason. You might try using procmon to identify all operations on the file set - it may shed light on what is going on.

5

Instead of Ctrl X and Ctrl P, do drag & drop or use rename. You can also try move file.

try it on same volume only. (it seems you are already doing it).

>I would like some kind of mechanism to make all directory renames to be of one of these option, consistently.

you mean that you want all rename operation to go either like point 1 or else point 2.

You are observing these operation in such manner as this is how the user mode app (explorer) implements it. There will surely be a set information for each rename or move but whether you get set_info for dir only or for every child or for few child files/dir depends upon the requester’s implementation.

What you want to achieve with this?

Thanks
Aditya

6

I’m writing a POC and want to prohibit the user from moving *.txt files.

Aditya - all file renames and moves are done by the same means of IRP_MJ_SET_INFORMATION and ALWAYS on the same logical volume.
renames across volumes are done via - create target-copy data-delete source.

rename without moving are of no interest to me, since they are to be allowed.

I also can’t control what the user will do, and must assume he always does his worst.

When the user renames the file, it’s easy - I get a rename, and can check the extension and fail the rename.
But When a directory is renamed, if all of the files are moved separately , there’s no problem.
Otherwise, I have to figure out a way to check all the files, which makes it much more difficult…

I would love it if there was some way I could ensure all files will always be renamed separately when a directory is renamed and moved.

Ariel.

7

"all file renames and moves are done by the same means of IRP_MJ_SET_INFORMATION and ALWAYS on the same logical volume. renames across volumes are done via - create target-copy data-delete source. "

True

"I would love it if there was some way I could ensure all files will always be renamed separately when a directory is renamed and moved. "

Directly, No, (Or at least I do not know abt any such method)

you can implement your own ways by retrieving file information (dir_control) and process move operation from ur handler. raise set_info for all files except .txt from ur handler and return original call with success. (Or do as per your requirement)

BUT It seems like changing the behavior exposed by the file system. An app believe that if it is going to raise a Move request on a dir than all files inside that directory will also move and if your filter will deny this; you brake app functionality.

Thanks
Aditya

8

Hi Aditya.

I was trying to avoid having to do the moving myself, but even if I do, I need some way to determine when the file will be moved by the user (explorer for instance) and when I have to move them myself -
If I always move them myself, I have to book keep the files I moved, and return success in cases when they are moved by the user.

All of the rename functions are independent of each other, other than the one which creates the directory.

Ariel.