Zwsetfileinformation failed ..

hello,

i am writing a filter driver , i have to rename a file whenever user deletes a specific file in C: drive. how can i do that.

thanks in advance

Well, there are many ways to delete files and i’d say the approaches are going to be somewhat different depending on how the file is deleted. But strictly speaking you will need to issue a FltSeInformationFile (or ZwSetInformationFile) with a FileRenameInformation class for the rename? How is that failing ?

Thanks,
Alex.

On Dec 20, 2012, at 7:04 AM, xxxxx@hcl.com wrote:

hello,

i am writing a filter driver , i have to rename a file whenever user deletes a specific file in C: drive. how can i do that.

thanks in advance


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Alex,

thanks for replying…
i am new to driver development.
i have to perform rename whenever user (shift+ delete) or (Normal delete) a file. so i am writing the code for renaming(ZwsetFileInformation) in IRP_MJ_CLOSE dispatch routine.
i am getting the handle for that file before user perform delete, by making that handle globally accessible.
if the approach is not corrent ,please correct me.

> Alex,

thanks for replying…
i am new to driver development.
i have to perform rename whenever user (shift+ delete) or (Normal delete)
a file. so i am writing the code for renaming(ZwsetFileInformation) in
IRP_MJ_CLOSE dispatch routine.
i am getting the handle for that file before user perform delete, by
making that handle globally accessible.
if the approach is not corrent ,please correct me.

Shift+Delete or Delete are user-interface actions which translate into
sequences of kernel calls to the file system. A file that is open cannot
be renamed or deleted; the caller will get an “access denied” error.

I have no idea what you mean by “making that handle globally acessible”
but it sounds like a very wrong thing to do. In general, for example, a
global or static variable in a driver represents a deep and fundamental
programming error because it has so many serious problems if not done
absolutely correctly; the nature of your question suggests that if you
have done this then you have done it without understanding the deep
problems.

It is not clear from this description what you are trying to accomplish.
joe


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Well, at a very high level the approach of changing a delete to a rename is fine. However, the details are not insignificant in this case. You have to deal with files opened with FILE_DELETE_ON_CLOSE and with files that are deleted inside transactions, and also with transactions that roll back (what if a file is created inside a transaction and then the transaction rolls back ? is the file deleted ?)

Anyway, from the subject of this post I understand that your call to ZwSetInformationFile fails and so it would be useful if you described what the problem that you are seeing is (how does it fail, how do you call it and so on).

I would recommend that you take a look at the Delete mini filter sample. If nothing else it should help you verify that you are not missing any cases where a file is deleted and that your understanding of the delete operation is correct.

Thanks,
Alex.

On Dec 20, 2012, at 11:25 PM, xxxxx@hcl.com wrote:

Alex,

thanks for replying…
i am new to driver development.
i have to perform rename whenever user (shift+ delete) or (Normal delete) a file. so i am writing the code for renaming(ZwsetFileInformation) in IRP_MJ_CLOSE dispatch routine.
i am getting the handle for that file before user perform delete, by making that handle globally accessible.
if the approach is not corrent ,please correct me.


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer