0

I am developing a mini-filter to intercept files and get the name of files which are dragged & dropped to a specific disk and get the file names.

If I drag & drop a file, I can get this file name and intercept it successfully (That's mean this file is not created on disk).

If I drag & drop multiple files, I can only get the first file name and other is not. But when I open the disk, I don't see any file here (That's mean Mini-Filter intercept them successfully). So I can not get the file names (except the first file)

I intercept drag & drop by redirect them:

  1. Get file name by FltGetFileNameInformation() then FltParseFileNameInformation()
  2. Split it two part
    • First is: \Device\HarddiskVolume1\folder\
    • Second is: file.ext
  3. Append a file name for first part: \Device\HarddiskVolume1\folder\new_file.ext
  4. Intercept create on disk
    • Release this buffer: Data->Iopb->TargetFileObject->FileName.Buffer
    • Assign first part to Data->Iopb->TargetFileObject->FileName
    • Set this: Data->Iopb->TargetFileObject->RelatedFileObject = NULL;
    • Data->IoStatus.Information = IO_REPARSE;
    • Data->IoStatus.Status = STATUS_REPARSE;
    • return FLT_PREOP_SUCCESS_NO_CALLBACK;

Above code can only intercept all files and get the first file name.

How can I do to intercept each file when I drag & drop multiple file?

4

2 回答 2

1

我发现自己：

  1. 从 Data->Iopb->TargetFileObject->FileName 获取文件名

    • 将其分为两部分：文件路径和文件名
    • 将文件名更改为重定向文件名

  2. 删除重定向文件名。此步骤可以在步骤 #1 之前运行

    • 如果重定向文件名不存在，则返回 STATUS_OBJECT_NAME_NOT_FOUND (0xC0000034)。对系统来说不是问题。
    • 如果重定向文件名存在。没关系。
于 2015-02-03T07:08:56.860 回答
0

确保您检查了Microsoft 的simrep示例，他们向您展示了如何正确执行此操作。我不会假设 Drag&Drop 在内核和文件系统中有对应关系。它可以在用户模式下以多种方式实现，特别是如果您在同一卷上执行此操作。它可以像重命名一样简单。还要记住硬链接和符号链接以及备用数据流。

祝你好运。

于 2018-01-26T19:44:47.387 回答