JACHYMKO: zaklad je de facto stejny jako minifilter samples "scanner" v IFSKitu. moje rutina na prevod jmena (ktera se vola v pre/post handlerech) je zde:
NTSTATUS ScannerGetDOSFileName(PUNICODE_STRING pUS, PCFLT_RELATED_OBJECTS pFltObjects, PFLT_FILE_NAME_INFORMATION pNameInfo) {
NTSTATUS status;
UNICODE_STRING us = {0,0,0};
PAGED_CODE();
if (!pFltObjects->FileObject->FileName.Length)
return STATUS_BUFFER_TOO_SMALL;
RtlInitUnicodeString(&us,NULL);
if (!NT_SUCCESS(status = IoVolumeDeviceToDosName(pFltObjects->FileObject->DeviceObject,&us)))
return status;
if (!NT_SUCCESS(status = RtlAppendUnicodeStringToString(pUS,&us))) {
RtlFreeUnicodeString(&us);
return status;
}
RtlFreeUnicodeString(&us);
if (pFltObjects->FileObject->RelatedFileObject) {
if (!NT_SUCCESS(status = RtlAppendUnicodeStringToString(pUS,&pFltObjects->FileObject->RelatedFileObject->FileName)))
return status;
if (!NT_SUCCESS(status = RtlAppendUnicodeToString(pUS,L"\\")))
return status;
if (!NT_SUCCESS(status = RtlAppendUnicodeStringToString(pUS,&pNameInfo->FinalComponent)))
return status;
} else {
if (!NT_SUCCESS(status = RtlAppendUnicodeStringToString(pUS,&pFltObjects->FileObject->FileName)))
return status;
}
DbgPrint("string %S\n",pUS->Buffer);
return status;
}