🚀 go-pugleaf

> > Does anyone know how to rename a file from NT Driver?
> > I can't find any functions to do that in NT DDK help.
> > Please give me some hints.
> >
>
> The function is IoCallDriver()
> The rename code may look like this:
>
> ==============================================================
> PFILE_RENAME_INFORMATION Rename = ... ;
> (initialize FILE_RENAME_INFORMATION with target file name)
>
> Irp = IoAllocateIrp( DeviceObject->StackSize, FALSE );
> if ( ! Irp ) return STATUS_INSUFFICIENT_RESOURCES;
>
> Irp->Flags |= IRP_BUFFERED_IO;
> Irp->RequestorMode = KernelMode;
> Irp->UserIosb = &IoStatus;
> Irp->UserEvent = &Event;
> Irp->Tail.Overlay.OriginalFileObject = FileObject;
> Irp->Tail.Overlay.Thread = PsGetCurrentThread();
> Irp->AssociatedIrp.SystemBuffer = (PVOID)&Rename;
>
> IrpSp = IoGetNextIrpStackLocation( Irp );
> IrpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
> IrpSp->FileObject = FileObject;
> IrpSp->DeviceObject = DeviceObject;
> IrpSp->Parameters.SetFile.Length = Length; // length of Rename
> IrpSp->Parameters.SetFile.FileInformationClass = FileRenameInformation;
> IrpSp->Parameters.SetFile.FileObject = FileObject;
> IrpSp->Parameters.SetFile.ReplaceIfExists = Rename->ReplaceIfExists;
>
> Status = IoCallDriver( DeviceObject, Irp );
> if (Status == STATUS_PENDING)
>     KeWaitForSingleObject( &Event, Executive, KernelMode,
>                            FALSE, (PLARGE_INTEGER)NULL);
>
> if (!NT_SUCCESS(Status)) IoStatus.Status = Status;
> return IoStatus.Status;
> ==============================================================
>
> Good luck,
> -Slava
>
> P.S FILE_RENAME_INFORMATION defined in one of Microsoft header
>     files as follows:
>
> typedef struct _FILE_RENAME_INFORMATION {
>     BOOLEAN ReplaceIfExists;
>     HANDLE RootDirectory;
>     ULONG FileNameLength;
>     WCHAR FileName[1];
> } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
>

Hi,
  using an IRP would be a difficult process.  Instead you can use
NtSetInformationFile(..) routine.  The prototype for the function is
NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationFile(
    IN HANDLE FileHandle,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    IN PVOID FileInformation,
    IN ULONG Length,
    IN FILE_INFORMATION_CLASS FileInformationClass
    );

FileInformation field will have the structure type FILE_RENAME_INFORMATION and
FileInformationClass will have enumerated type FileRenameInformation (ntddk.h)

Jaimon

-----== Posted via Deja News, The Leader in Internet Discussion ==-----
http://www.dejanews.com/   Now offering spam-free web-based newsreading