changing file name in IRP_MJ_CREATE

I am developing a mini filter driver, which changes file name to be opened/created in
pre-callback routine of IRP_MJ_CREATE,for which we do :

1) We replace the existing filename buffer of
Data->Iopb->TargetFileObject->FileName to the new file name.

2) And return the following status:

Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
callbackFilterStatus = FLT_PREOP_COMPLETE;


After that files gets successfully created.

But when I am trying to open the file in wordpad, modify the contents and try to save the
file, I get Save AS prompt, as if the file does not exists.

I don’t see this behavior in case of Notepad.


Has anybody faced such an issue while renaming files in IRP_MJ_CREATE?

Читайте также:

  • Ничего не найдено

One thought on “changing file name in IRP_MJ_CREATE

  1. anonim

    You also need to handle IRP_MJ_NETWORK_QUERY_OPEN in your reparse driver.
    But network queries come down as Fast IO, which cannot be redirected with STATUS_REPARSE.
    you need to add the following code in your pre-create-callback routine:
    if (
         (Data->Iopb->MajorFunction == IRP_MJ_NETWORK_QUERY_OPEN) &&