KINUX STORY

검색어 '파일명 얻기'에 대한 1 개의 검색 결과

2007/09/11 미니필터 드라이버에서 파일 풀패스명 얻기 by 키눅스 (4)

미니필터 드라이버에서 파일 풀패스명 얻기

2007/09/11 21:14 / 프로그래밍/소스/팁

미니필터 드라이버에서 I/O 연산시 파일 풀패스명을 얻는 함수를 작성하였습니다.
미니필터 드라이버에서는 파일명 및 파일 정보를 얻기 위해 필터 매니저에서 제공하는 FltGetFileNameInformation() 함수를 사용하여 얻을 수 있지만 이 함수가 실패하는 경우가 있습니다. 그것도 자주...(자세한 내용은 WDK 도움말을 참조하십시오)

NTSTATUS
MiniGetFileName(IN PFLT_CALLBACK_DATA Data,
			   IN PCFLT_RELATED_OBJECTS FltObjects,
			   OUT PUNICODE_STRING pFullPathName)
{
	PFLT_FILE_NAME_INFORMATION	pFileNameInfo = NULL;
	NTSTATUS					Status = STATUS_SUCCESS;

//파일 객체가 NULL 이거나 콜백 데이터가 NULL 인 경우 리턴
	if(FltObjects->FileObject == NULL || Data == NULL)
	{
		Status = STATUS_UNSUCCESSFUL;
		return Status;
	}

//FLT_FILE_NAME_INFORMATION 정보를 쿼리
	Status = FltGetFileNameInformation(Data,
			FLT_FILE_NAME_NORMALIZED | 
			FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
			&pFileNameInfo);

if(NT_SUCCESS(Status))
	{
		//FLT_FILE_NAME_INFORMATION 정보를 얻어 오면 OUT 인자에 풀패스 파일명 복사
		if(pFileNameInfo->Name.Length > 0)
		{
			RtlUnicodeStringCopy(pFullPathName, &pFileNameInfo->Name);
		}
	}
	else
	{
		//FLT_FILE_NAME_INFORMATION 정보를 얻어오지 못한 경우 FLT_FILE_NAME_OPENED 방식으로 다시 쿼리
		Status = FltGetFileNameInformation(Data,
				FLT_FILE_NAME_OPENED | 
				FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP,
				&pFileNameInfo);

if(NT_SUCCESS(Status))
		{
			//FLT_FILE_NAME_INFORMATION 정보를 얻어 오면 OUT 인자에 풀패스 파일명 복사
			if(pFileNameInfo->Name.Length > 0)
			{
				RtlUnicodeStringCopy(pFullPathName, &pFileNameInfo->Name);
			}
		}
		else
		{
			//FltGetFileNameInformation() 함수로 파일 정보를 얻어오지 못하는 경우
			//FileObject에 직접 접근하여 파일명을 얻어옴
			//FileObject 에 있는 파일명은 볼륨(디바이스) 정보가 없는 풀 패스명이므로 볼륨명을 얻어서
			//볼륨명 뒤에 FileObject의 파일명을 붙여서 풀패스명을 만듦
			ULONG Size;
			UNICODE_STRING szTempPath;
			UNICODE_STRING szDevice;
			UNICODE_STRING szFileNameDevice;

//FileObject->FileName 이 볼륨정보를 포함하고 있는지 체크
			szFileNameDevice.Length = FltObjects->FileObject->FileName.Length;
			szFileNameDevice.MaximumLength = FltObjects->FileObject->FileName.MaximumLength;
			szFileNameDevice.Buffer = ExAllocatePoolWithTag(NonPagedPool, szFileNameDevice.MaximumLength, 'iNiM');
			if(szFileNameDevice.Buffer == NULL)
			{
				return STATUS_UNSUCCESSFUL;
			}

RtlInitUnicodeString(&szDevice, L"\\Device");
			
			if(FltObjects->FileObject->FileName.Length >= szDevice.Length)
			{
				RtlUnicodeStringCchCopyN(&szFileNameDevice, &FltObjects->FileObject->FileName, 7);
			}

if(RtlEqualUnicodeString(&szDevice, &szFileNameDevice, TRUE))
			{
				RtlUnicodeStringCopy(pFullPathName, &FltObjects->FileObject->FileName);
			} 
			else 
			{
				//볼륨정보를 얻어와서 연결 시킴
				szTempPath.Length = 0;
				szTempPath.MaximumLength = FltObjects->FileObject->FileName.MaximumLength + 2;

Status = FltGetVolumeName(FltObjects->Volume, NULL, &Size);
				if(Status == STATUS_BUFFER_TOO_SMALL)
				{
					szTempPath.MaximumLength += (USHORT)Size;
					szTempPath.Buffer = ExAllocatePoolWithTag(NonPagedPool, szTempPath.MaximumLength, 'iNiM');

if(szTempPath.Buffer != NULL)
					{
						Status = FltGetVolumeName(FltObjects->Volume, &szTempPath, &Size);
						if(NT_SUCCESS(Status))
						{
							RtlUnicodeStringCat(&szTempPath, &FltObjects->FileObject->FileName);
							RtlUnicodeStringCopy(pFullPathName, &szTempPath);
						}
						ExFreePoolWithTag(szTempPath.Buffer, 'iNiM');
					}
				}
			}
			ExFreePoolWithTag(szFileNameDevice.Buffer, 'iNiM');
		}
	}

//FltGetFileNameInformation() 함수로 얻어온 FLT_FILE_NAME_INFORMATION 을 해제해 주어야 함
	if(pFileNameInfo != NULL)
	{
		FltReleaseFileNameInformation(pFileNameInfo);
	}

return Status;
}

위 함수는 Pre/Post Operation Callback 루틴에서 아래와 같이 사용하시면 됩니다.

※ 주의 : 코드는 실제 적용 코드에서 블로깅을 위해 수정된 것입니다. 사용하실때는 코드 검증및 테스트를 하시고 사용하시기 바랍니다.

미니필터 드라이버 기반 파일 모니터링 프로그램이 어느정도 완성되었습니다. 현재 테스트 중이고, 곧 업로드 하도록 하겠습니다.

[스크린샷]

키눅스 이 작성.

TAGS FltGetFileNameInformation, 미니필터 드라이버, 파일명 얻기

47 개의 트랙백 , 4 개의 댓글

Trackback URL : http://kinux.comgosu.net/trackback/300

emma stone
Tracked from emma stone 2011/06/07 09:04
nikki reed <a href="http://blogs.articlesforknowledgesharing.com/cqnikki-reed">nikki reed</a> reese witherspoon <a href="http://www.extendpicasa.org/screese-witherspoon">reese witherspoon</a>
nikki reed
Tracked from nikki reed 2011/06/07 12:28
nikki reed http://ibuyitunesyoutubeyahoomyspaceisfacebookgooglemelive.com/zmnikki-reed.html nikki reed
ernest hemingway
Tracked from ernest hemingway 2011/06/07 16:50
autozone http://qixuan.kelvinkau.com/ljautozone autozone
ernest hemingway
Tracked from ernest hemingway 2011/06/07 18:18
rep weiner <a href="http://maldenbowmen.org/tlrep-weiner/">rep weiner</a> mark jackson <a href="http://startubuntu.com/dqmark-jackson">mark jackson</a>
mark jackson
Tracked from mark jackson 2011/06/07 18:30
discovery channel <a href="http://buysalvialeaf.com/pldiscovery-channel/">discovery channel</a> sign language <a href="http://serenitypetservices.com/txsign-language/">sign language</a>
horton
Tracked from horton 2011/06/07 18:43
steve jobs health <a href="http://www.johannzarco.com/nlsteve-jobs-health.html">steve jobs health</a> icloud <a href="http://quotesproverbs.com/gbicloud">icloud</a>
icloud
Tracked from icloud 2011/06/07 18:55
nintendo 3ds <a href="http://partnerchurches.com/ktnintendo-3ds.html">nintendo 3ds</a> andrew breitbart <a href="http://partnerchurches.com/ktandrew-breitbart.html">andrew breitbart</a>
mark jackson
Tracked from mark jackson 2011/06/07 19:07
lenny dykstra <a href="http://blog.cottinghamchalk.net/gslenny-dykstra">lenny dykstra</a> george stephanopoulos <a href="http://symbiosisdev.com/phgeorge-stephanopoulos">george stephanopoulos</a>
andrew breitbart
Tracked from andrew breitbart 2011/06/07 19:22
andrew breitbart <a href="http://lourolls.com/jcandrew-breitbart">andrew breitbart</a> bioshock infinite <a href="http://metaphysicalbeliefs.org/cqbioshock-infinite.html">bioshock infinite</a>
lenny dykstra
Tracked from lenny dykstra 2011/06/07 19:36
andrew breitbart <a href="http://jsiegal.com/szandrew-breitbart">andrew breitbart</a> ernest hemingway <a href="http://letschangetheworld.info/jcernest-hemingway.html">ernest hemingway</a>
icloud
Tracked from icloud 2011/06/07 19:49
congressman weiner <a href="http://isthisrumortrue.com/trcongressman-weiner">congressman weiner</a> emily maynard <a href="http://hunkythumbs.com/thumbs/page.php?k=emily-maynard">emily maynard</a>
lenny dykstra
Tracked from lenny dykstra 2011/06/07 20:02
lenny dykstra <a href="http://lolcartoons.com/vglenny-dykstra">lenny dykstra</a> sign language <a href="http://startubuntu.com/dqsign-language">sign language</a>
nintendo 3ds
Tracked from nintendo 3ds 2011/06/07 20:14
bioshock infinite <a href="http://lolcartoons.com/vgbioshock-infinite">bioshock infinite</a> bubba starling <a href="http://sharpstep.com/mnbubba-starling/">bubba starling</a>
bioshock infinite
Tracked from bioshock infinite 2011/06/07 20:26
nintendo 3ds <a href="http://opossum-musings.com/xfnintendo-3ds/">nintendo 3ds</a> congressman weiner <a href="http://kaka8.info/xkcongressman-weiner/">congressman weiner</a> paul revere <a href="http://evancairo.com/fjpaul-revere/">paul revere</a>
sign language
Tracked from sign language 2011/06/07 20:46
bubba starling <a href="http://yaht.su/wp-content/backup-1c9e7/page.php?k=bubba-starling">bubba starling</a> mark jackson <a href="http://marketing-madeeasy.com/wlmark-jackson/">mark jackson</a> bioshock infinite <a href="http://kaka8.info/xkbioshock-i...
sign language
Tracked from sign language 2011/06/07 21:00
icloud <a href="http://moderncocktailrecipes.com/wzicloud/">icloud</a> bubba starling <a href="http://blog.mobida2.com/vmbubba-starling/">bubba starling</a> bobby fischer <a href="http://andamanholidays.com/cxbobby-fischer/">bobby fischer</a>
george stephanopoulos
Tracked from george stephanopoulos 2011/06/07 21:12
steve jobs health <a href="http://www.notgettingpregnant.com/rmsteve-jobs-health/">steve jobs health</a> mark jackson <a href="http://www.therantingpersian.com/wvmark-jackson/">mark jackson</a> george stephanopoulos <a href="http://kaka8.info/xkgeorge-...
icloud
Tracked from icloud 2011/06/07 21:26
george stephanopoulos <a href="http://blog.decoplus-parquet.com/bsgeorge-stephanopoulos/">george stephanopoulos</a> horton <a href="http://3folks.com/fdhorton/">horton</a> horton <a href="http://newsite.teesdaleloof.com/cthorton/">horton</a>
economics
Tracked from economics 2011/06/07 23:33
technology <a href="http://swing-golfer.com/bttechnology/">technology</a> scientific method <a href="http://qixuan.kelvinkau.com/ljscientific-method">scientific method</a>
technology
Tracked from technology 2011/06/07 23:55
mark jackson <a href="http://neibeautycare.net/msmark-jackson/">mark jackson</a> os x lion <a href="http://www.weddingspeechesandmore.com/fkos-x-lion">os x lion</a>
justin timberlake and mila kunis
Tracked from justin timberlake and mila kunis 2011/06/08 02:30
psychology <a href="http://qixuan.kelvinkau.com/ljpsychology">psychology</a> circulatory system <a href="http://serenitypetservices.com/txcirculatory-system/">circulatory system</a>
psychology
Tracked from psychology 2011/06/08 02:42
shavuot <a href="http://hunkythumbs.com/thumbs/page.php?k=shavuot">shavuot</a> circulatory system <a href="http://ravingbikefiend.com/bwcirculatory-system.html">circulatory system</a>
lauryn hill
Tracked from lauryn hill 2011/06/08 05:01
literature <a href="http://plen-aire.malsbury.net/nxliterature/">literature</a> entrepreneur <a href="http://mov.eecssh.com/rxentrepreneur.html">entrepreneur</a>
os x lion
Tracked from os x lion 2011/06/08 05:24
lenny dykstra <a href="http://louisianaweightlosssurgery.com/fllenny-dykstra/">lenny dykstra</a> health <a href="http://www.houseandgardensma.com/xqhealth/">health</a> scientific method <a href="http://mtlg.co.uk/phscientific-method/">scientific method...
apple cloud
Tracked from apple cloud 2011/06/08 05:24
entrepreneur <a href="http://jjpromoproductsblog.com/llentrepreneur/">entrepreneur</a> psychology <a href="http://buysalvialeaf.com/plpsychology/">psychology</a>
psychology
Tracked from psychology 2011/06/08 05:51
mlb draft <a href="http://buysalviasmoke.com/wcmlb-draft.html">mlb draft</a> skeletal system <a href="http://jjpromoproductsblog.com/llskeletal-system/">skeletal system</a>
economics
Tracked from economics 2011/06/08 06:10
os x lion <a href="http://mdshortsalerealestate.com/ppos-x-lion/">os x lion</a> mlb draft <a href="http://bassfishing.massivemarketers.com/nxmlb-draft/">mlb draft</a> mlb draft <a href="http://sociallyawkward.korpserkrafiks.com/gjmlb-draft/">mlb draft<...
human centipede
Tracked from human centipede 2011/06/08 06:45
shavuot <a href="http://dankubelka.com/vwshavuot/">shavuot</a> scientific method <a href="http://pressedup.com/hrscientific-method/">scientific method</a> piper perabo <a href="http://www.yogaenergy.net/trpiper-perabo/">piper perabo</a>
science
Tracked from science 2011/06/08 07:27
entrepreneur <a href="http://meadowscounselingcenter.com/zmentrepreneur/">entrepreneur</a> apple cloud <a href="http://housefriendship.bgettings.com/bsapple-cloud/">apple cloud</a> human centipede <a href="http://yourlifemadison.com/hzhuman-centipede/"...
science
Tracked from science 2011/06/08 08:05
mark jackson <a href="http://blog.techcubicles.com/wp-content/themes/page.php?k=mark-jackson">mark jackson</a> health <a href="http://kalipinckney.com/zqhealth/">health</a> health <a href="http://www.notgettingpregnant.com/rmhealth/">health</a>
economics
Tracked from economics 2011/06/08 08:49
piper perabo <a href="http://www.findingmacedonia.com/ndpiper-perabo/">piper perabo</a> piper perabo <a href="http://australiancitizenshiptest.org/zxpiper-perabo/">piper perabo</a> os x lion <a href="http://www.dikkebueno.com/rros-x-lion/">os x lion</a>
justin timberlake and mila kunis
Tracked from justin timberlake and mila kunis 2011/06/08 09:01
history <a href="http://www.extendpicasa.org/schistory">history</a> science <a href="http://newto.org/ltscience">science</a>
justin timberlake and mila kunis
Tracked from justin timberlake and mila kunis 2011/06/08 09:48
human centipede <a href="http://jjpromoproductsblog.com/llhuman-centipede/">human centipede</a> shavuot <a href="http://listenandlearn.james5.org/llshavuot/">shavuot</a>
apple cloud
Tracked from apple cloud 2011/06/08 10:06
lenny dykstra <a href="http://gaviotatravels.com/hdlenny-dykstra/">lenny dykstra</a> economics <a href="http://www.americairemember.com/hxeconomics/">economics</a> health <a href="http://footballallday.com/wshealth/">health</a>
shavuot
Tracked from shavuot 2011/06/08 10:44
apple cloud <a href="http://www.americairemember.com/hxapple-cloud/">apple cloud</a> os x lion <a href="http://souljourney.com/mgos-x-lion/">os x lion</a> shavuot <a href="http://www.belbride.com/xsshavuot/">shavuot</a>
mlb draft
Tracked from mlb draft 2011/06/08 11:33
mark jackson <a href="http://marketing-madeeasy.com/wlmark-jackson/">mark jackson</a> wesley snipes <a href="http://wmich.uswindle.com/cswesley-snipes/">wesley snipes</a> apple cloud <a href="http://mtlg.co.uk/phapple-cloud/">apple cloud</a>
shavuot
Tracked from shavuot 2011/06/08 12:14
mlb draft <a href="http://blog.techcubicles.com/wp-content/themes/page.php?k=mlb-draft">mlb draft</a> economics <a href="http://blog.decoplus-parquet.com/bseconomics/">economics</a> os x lion <a href="http://battleridgenorthchastain.com/pcos-x-lion/">o...
printable contact lens solution coupon
Tracked from printable contact lens solution coupon 2011/08/03 22:52
printable 100 number chart <a href="http://stifimo.mct.gov.mz/lib/Tree/page.php?k=printable-100-number-chart">printable 100 number chart</a> printable asl sign cards <a href="http://www.drudecja.de/zgprintable-asl-sign-cards/">printable asl sign cards<...
ocean coloring page printable
Tracked from ocean coloring page printable 2011/08/04 00:02
free printable family tree format <a href="http://www.coolrunners.co.uk/cms/page.php?k=free-printable-family-tree-format">free printable family tree format</a> free printable dollhouse furniture <a href="http://www.nwparts.ru/modules/TinyMCE/page.php?k...
printable father's day coupons
Tracked from printable father's day coupons 2011/08/04 03:23
printable movie crossword puzzles <a href="http://www.collaresydemas.com/tmp/templates_c/page.php?k=printable-movie-crossword-puzzles">printable movie crossword puzzles</a> free printable clip art congratulations <a href="http://www.edenvalleycomputers...
free printable moving announcement cards
Tracked from free printable moving announcement cards 2011/08/04 03:32
blank checks printables for students <a href="http://www.progreenpainting.org/modules/News/page.php?k=blank-checks-printables-for-students">blank checks printables for students</a> printable plant animal venn diagram <a href="http://www.guestranchesinc...
free printable disney coloring
Tracked from free printable disney coloring 2011/08/04 04:25
free printable award coupons <a href="http://www.kaval.bg/uploads/lang/page.php?k=free-printable-award-coupons">free printable award coupons</a> printable baby boy card <a href="http://tafeweb.com/fsprintable-baby-boy-card/">printable baby boy card</a>
printables with two demensional shapes
Tracked from printables with two demensional shapes 2011/08/04 05:30
printable beginning instructions for guitar <a href="http://residence-sainte-therese.org/tmp/configs/page.php?k=printable-beginning-instructions-for-guitar">printable beginning instructions for guitar</a> printable dick sporting goods coupons <a href="...
free printable greeting cards halloween
Tracked from free printable greeting cards halloween 2011/08/04 07:08
printable sheets on stranger danger <a href="http://residence-sainte-therese.org/tmp/configs/page.php?k=printable-sheets-on-stranger-danger">printable sheets on stranger danger</a> printable prescription transfer gift card <a href="http://www.deconvenc...
printable blank calendar sheets
Tracked from printable blank calendar sheets 2011/08/04 08:13
printable pictures to color cooking <a href="http://www.hoezomiddendelflandsnelweg.nl/tmp/configs/page.php?k=printable-pictures-to-color-cooking">printable pictures to color cooking</a> blank music theory printables <a href="http://www.akop.biz/tmp/tem...
free printable perfect attendance certificates
Tracked from free printable perfect attendance certificates 2011/08/04 10:06
free printable subtraction flash cards <a href="http://sealclub.net/njfree-printable-subtraction-flash-cards/">free printable subtraction flash cards</a> printable door hanger office depot <a href="http://www.klikka.biz/hesk/inc/page.php?k=printable-do...
printable drawings of hindu symbols
Tracked from printable drawings of hindu symbols 2011/08/04 10:08
blank lesson planners printable <a href="http://ot-kuzi.ru/ckblank-lesson-planners-printable/">blank lesson planners printable</a> printable solos for viola <a href="http://www.edenvalleycomputers.co.uk/j1/xmlrpc/page.php?k=printable-solos-for-viola">p...