Rename file Preoperation Windows Minifilter driver - c

Question

I have a minifilter driver and would like to action file renames but i am unsure how to get the new file name. I would like to run the new filename through the same criteria as Creating a file - IRP_MJ_CREATE.
I currently monitor all files within the filter and move accordingly on a set of rules.
I have found a link on SO that relates to cancelling a rename, but unsure how to get the new filename.
The link is How to cancel a rename operation in minifilter driver
At this moment i can get the existing file name in case FileRenameInformation but i need to know what the new file name information is.
I have tried using :
PFILE_RENAME_INFORMATION renameInfo
Iopb->Parameters.SetFileInformation.InfoBuffer;
In the switch - FileRenameInformation, but the output is always empty.
My PreOperation callback is as follows:
FLT_PREOP_CALLBACK_STATUS PreOperationCallback(_Inout_
PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID* CompletionContext)
{
PFILE_RENAME_INFORMATION renameInfo;
//WCHAR buf[4096] = { 0 };
/* IRP-based I/O operation? */
if (FLT_IS_IRP_OPERATION(Data)) {
/* Open file? */
if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
/* Open file for writing/appending? */
if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
(FILE_WRITE_DATA | FILE_APPEND_DATA)) {
return process_irp(Data, FltObjects, CompletionContext, DEFERRED_IO, FALSE);
}
} else if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION) {
switch (Data->Iopb->Parameters.SetFileInformation.FileInformationClass) {
case FileDispositionInformation:
if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
}
break;
case FileEndOfFileInformation:
case FileRenameInformation:
//https://stackoverflow.com/questions/40564824/how-to-cancel-a-rename-operation-in-minifilter-driver
renameInfo = Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
//memcpy(buf, renameInfo->FileName, renameInfo->FileNameLength);
DbgPrint("Rename info - '%wZ'", renameInfo->FileName);
return process_irp(Data, FltObjects, CompletionContext, FALSE, TRUE);
}
}
}
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

Answer 1

The issue lies in the DbgPrint you need to use %ws
FLT_PREOP_CALLBACK_STATUS PreOperationCallback(_Inout_
PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID* CompletionContext)
{
PFILE_RENAME_INFORMATION renameInfo;
//WCHAR buf[4096] = { 0 };
/* IRP-based I/O operation? */
if (FLT_IS_IRP_OPERATION(Data)) {
/* Open file? */
if (Data->Iopb->MajorFunction == IRP_MJ_CREATE) {
/* Open file for writing/appending? */
if (Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess &
(FILE_WRITE_DATA | FILE_APPEND_DATA)) {
return process_irp(Data, FltObjects, CompletionContext, DEFERRED_IO,
FALSE);
}
} else if (Data->Iopb->MajorFunction == IRP_MJ_SET_INFORMATION) {
switch (Data->Iopb->Parameters.SetFileInformation.FileInformationClass) {
case FileDispositionInformation:
if (((FILE_DISPOSITION_INFORMATION*) Data->Iopb->Parameters.SetFileInformation.InfoBuffer)->DeleteFile) {
return process_irp(Data, FltObjects, CompletionContext, FALSE, FALSE);
}
break;
case FileEndOfFileInformation:
case FileRenameInformation:
DbgPrint("Original file - '%wZ'", name_info->Name);
renameInfo = Data->Iopb->Parameters.SetFileInformation.InfoBuffer;
DbgPrint("Rename info length- '%u'", renameInfo->FileNameLength);
DbgPrint("Rename File info - '%ws'", renameInfo->FileName);
return process_irp(Data, FltObjects, CompletionContext, FALSE, TRUE);
}
}
}
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}
You can call get_file_name_information to get the original file location in the code above like:
PFLT_FILE_NAME_INFORMATION name_info;
get_file_name_information(Data, &name_info);
//Release
FltReleaseFileNameInformation(name_info);
Now there is one problem the rename->FileName is in a different format to name_info->Name
The example below rename C:\temp\1.rtf to C:\temp\12.rtf
DbgPrint("Original file - '%wZ'", name_info->Name);
Will be in the format\output of:
\Device\HarddiskVolume4\Temp\1.rtf
Where as the
DbgPrint("Rename File info - '%ws'", renameInfo->FileName);
Will be in the format\output of:
\??\C:\Temp\12.rtf
BOOLEAN get_file_name_information(PFLT_CALLBACK_DATA data,
PFLT_FILE_NAME_INFORMATION* name_info)
{
/* Get name information. */
if (NT_SUCCESS(FltGetFileNameInformation(
data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
name_info
))) {
/* Parse file name information. */
if (NT_SUCCESS(FltParseFileNameInformation(*name_info))) {
return TRUE;
}
FltReleaseFileNameInformation(*name_info);
#if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
} else {
/*
* We couldn't get the "normalized" name, try to get the "opened"
* name.
*/
if (NT_SUCCESS(FltGetFileNameInformation(data,
FLT_FILE_NAME_OPENED |
FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
name_info
))) {
if (NT_SUCCESS(FltParseFileNameInformation(*name_info))) {
return TRUE;
}
FltReleaseFileNameInformation(*name_info);
}
#endif /* OSVER(NTDDI_VERSION) > NTDDI_WIN2K */
}
return FALSE;
}
Not sure whether this needs to be another post on Stack overflow, but if anyone knows how to change the rename->FileName to the same format/structure as name_info->Name, can they update the answer.