minifilter driver in win11.
If implement GenerateFileName with FilterRegistration ，once deleting file in Partition C, it prompts:
Can’t read from the source file or disk.
If I change NcGenerateFileName to NULL,it work well. Why?
CONST FLT_REGISTRATION FilterRegistration = {
sizeof( FLT_REGISTRATION ), // Size
FLT_REGISTRATION_VERSION, // Version
0, // Flags
ContextNotifications, // Context
Callbacks, // Operation callbacks
FilterUnload, // MiniFilterUnload
InstanceSetup, // InstanceSetup
InstanceQueryTeardown, // InstanceQueryTeardown
NULL, // InstanceTeardownStart
NULL, // InstanceTeardownComplete
NcGenerateFileName, // GenerateFileName
NormalizeNameComponent, // GenerateDestinationFileName
NULL // NormalizeNameComponent
};
NTSTATUS
FLTAPI GenerateFileName( Instance, FileObject, CallbackData, NameOptions, CacheFileNameInformation, FileName)
{
...
ClearFlag(NameOptions, FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER);
if (FlagOn(NameOptions, FLT_FILE_NAME_NORMALIZED)){
ClearFlag(NameOptions, FLT_FILE_NAME_NORMALIZED);
SetFlag(NameOptions, FLT_FILE_NAME_OPENED);
}
if (CallbackData){
Status = FltGetFileNameInformation(CallbackData, NameOptions, &FileNameInformation);
}
else{
Status = FltGetFileNameInformationUnsafe(StreamObject, Instance, NameOptions, &FileNameInformation);
}
Status = FltCheckAndGrowNameControl(FileName, FileNameInformation->Name.Length);
....
RtlCopyUnicodeString(&FileName->Name, &FileNameInformation->Name);
....
Status = STATUS_SUCCESS;
...
return Status;
}~~~~