none
IRP_MJ_CREATE : Why FileName is always uppercase ? RRS feed

  • Question

  • Hello,

    I am on a virtualfile filesystem driver and when the system (Windows OS) requests opening / file creation,
    in the irp function: irp_mj_create -> file_object.FileName : always have the file name in uppercase.
    How to make sure that file_object.FileName is not always in uppercase ???

    Sample i run process \testprocess\testmfc.exe then in irp_mj_create , i see
    \TESTPROCESS\TESTMFC.EXE (in uppercase).
    Why ?

    Thank you
    • Edited by Sizy458 Thursday, June 28, 2018 5:42 PM
    Thursday, June 28, 2018 5:42 PM

Answers

  • Are you mounting your filesystem using a reparse point? NTFS does some funky things with upcasing file names on reparse points

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Thursday, June 28, 2018 7:36 PM
    Moderator

All replies

  • Why do you care? What is the larger problem that you're trying to solve?

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Thursday, June 28, 2018 6:13 PM
    Moderator
  • When I run a process hosted in my virtual disk file system,

    then the taskmanager (taskmgr.exe) displays always the imagename of my process in UPPERCASE.

    Thursday, June 28, 2018 7:07 PM
  • Are you mounting your filesystem using a reparse point? NTFS does some funky things with upcasing file names on reparse points

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Thursday, June 28, 2018 7:36 PM
    Moderator
  • I use ioctl function FSCTL_SET_REPARSE_POINT ,
    for mount my virtual disk filesystem.

    So how to solve the problem about uppercase letters  ?

    Thank.

    • Edited by Sizy458 Friday, June 29, 2018 6:55 AM
    Friday, June 29, 2018 6:43 AM
  • This behavior is marginally documented and, to my mind, broken. Look here for the explanation by RBMM

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Friday, June 29, 2018 6:36 PM
    Moderator