Im experiencing a weird behaviour related to my mini filter and reparses made by another 3rd party filter down the stack. A call to FltGetFileInformation fails with error STATUS_INVALID_DEVICE_OBJECT_PARAMETER when called from PostCreate inside my filter.
Further debugging revealed that the file for which FltGetFileInformation fails is a “reparse destination”, meaning that another filter below mine returned STATUS_REPASE on a previous create, and then the I/O manager re-opened it again on the target device. The failure is during the 2nd create (on the destination/target device).
If i break in PostCreate in my mini filter i see that the volume is the reparse target (e.g \Device\TargetDevice) but the FileName field in the file object has the source device:
_UNICODE_STRING “\Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\test.txt”
How can i safely obtain the file name from my filter in this case?
> Im experiencing a weird behaviour related to my mini filter and
reparses made by another 3rd party filter down the stack. A call to
FltGetFileInformation fails with error
STATUS_INVALID_DEVICE_OBJECT_PARAMETER when called from PostCreate
inside my filter.
Further debugging revealed that the file for which
FltGetFileInformation fails is a “reparse destination”, meaning that
another filter below mine returned STATUS_REPASE on a previous create,
and then the I/O manager re-opened it again on the target device. The
failure is during the 2nd create (on the destination/target device).
If i break in PostCreate in my mini filter i see that the volume is the
reparse target (e.g \Device\TargetDevice) but the FileName field in the
file object has the source device:
_UNICODE_STRING “\Device\HarddiskVolume1\Documents and
Settings\Administrator\Desktop\test.txt”
Can you please do a !object on the device object in the file object and also
on file object in both the cases:
- When reparse is returned
- when reparse is not returned
Regards,
Ayush Gupta
AI Consulting