none
FileObject->FileName not returning complete path of a file RRS feed

  • Question

  • I'm a newbie in Driver developing field. I'm trying to display path of every file which opens. I'm using following line for displaying path.

    PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;
    DbgPrint("File Name : %wZ\n", &pFileObject->FileName);

    But it is not displaying complete path.

    File Name : \Documents and Settings\Administrator\Desktop\cmd commands.txt

    it should be like this:

    File Name : C:\Documents and Settings\Administrator\Desktop\cmd commands.txt

    Drive name (e.g C:, D:) is missing, is any thing wrong...?

    Sunday, December 30, 2012 5:22 PM

Answers

  • First this looks like you are using a legacy file system filter, if so stop now and move to a mini-filter.  Second the volume is not part of the file name since the file system is for a specific volume and the instance of your driver should know what the volume (what you call drive name) is.   Also be aware that your code will not nessecarily work as shown since you can have relative opens, and opens by ID, which will not work with what you are doing.

    I would step back and build and debug minispy from the WDK.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Sunday, December 30, 2012 5:51 PM