Weird filename input to Create File

NTFSD
1

This happens when creating a directory (after dir has been created). I get
an IRP_MJ_CREATE, attempting to open a file using the following string for a
name:

FileName struct _UNICODE_STRING
“:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA”
Length 0x5a
MaximumLength 0x78
Buffer 0xe18aa518

The new folder is passed as the RelatedFileObject.

Any ideas anyone?

Thanks,
Jeremy

2

This is trying to open a stream named
“{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}”
on the RelatedFileObject.

It looks like this is stream is related to the shell’s summary information
on a file.

See:
http://linux-ntfs.sourceforge.net/ntfs/attributes/data.html
http://linux-ntfs.sourceforge.net/ntfs/concepts/file.html

  • Danilo

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Sherrill
Sent: Tuesday, February 03, 2004 6:44 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Weird filename input to Create File

This happens when creating a directory (after dir has been created). I get
an IRP_MJ_CREATE, attempting to open a file using the following string for a
name:

FileName struct _UNICODE_STRING
“:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA”
Length 0x5a
MaximumLength 0x78
Buffer 0xe18aa518

The new folder is passed as the RelatedFileObject.

Any ideas anyone?

Thanks,
Jeremy

3

Possibly some SHELL32’s stuff like DESKTOP.INI or its modern replacements.
Try using “md” from command line to create the directory.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Jeremy Sherrill”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, February 04, 2004 5:43 AM
Subject: [ntfsd] Weird filename input to Create File

> This happens when creating a directory (after dir has been created). I get
> an IRP_MJ_CREATE, attempting to open a file using the following string for a
> name:
>
> FileName struct _UNICODE_STRING
> “:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA”
> Length 0x5a
> MaximumLength 0x78
> Buffer 0xe18aa518
>
> The new folder is passed as the RelatedFileObject.
>
> Any ideas anyone?
>
> Thanks,
> Jeremy
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com